phorphiex | 03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0011000000023ab7-10.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4764 created 3416	4764	2264621103.exe	56
PID 4764 created 3416	4764	2264621103.exe	56
PID 2848 created 3416	2848	winupsecvmgr.exe	56
PID 2848 created 3416	2848	winupsecvmgr.exe	56
PID 2848 created 3416	2848	winupsecvmgr.exe	56

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral2/memory/2848-136-0x00007FF668AD0000-0x00007FF669067000-memory.dmp	xmrig
behavioral2/memory/3756-139-0x00007FF6CD720000-0x00007FF6CDF0F000-memory.dmp	xmrig
behavioral2/memory/3756-141-0x00007FF6CD720000-0x00007FF6CDF0F000-memory.dmp	xmrig
behavioral2/memory/3756-143-0x00007FF6CD720000-0x00007FF6CDF0F000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4040	powershell.exe
3708	powershell.exe
3644	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	2277412582.exe

Executes dropped EXE 9 IoCs

pid	Process
2348	80C9.exe
1188	3017714562.exe
3220	sysppvrdnvs.exe
3536	2277412582.exe
452	46903692.exe
3508	1652927828.exe
4764	2264621103.exe
3484	105918889.exe
2848	winupsecvmgr.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	3017714562.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 980	2848	winupsecvmgr.exe	133
PID 2848 set thread context of 3756	2848	winupsecvmgr.exe	134

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\checkwritepermissions.exe	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysppvrdnvs.exe	3017714562.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	3017714562.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4208	sc.exe
4212	sc.exe
1656	sc.exe
1748	sc.exe
1252	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3017714562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80C9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46903692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1652927828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	105918889.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4040	powershell.exe
4040	powershell.exe
3536	2277412582.exe
4764	2264621103.exe
4764	2264621103.exe
3708	powershell.exe
3708	powershell.exe
4764	2264621103.exe
4764	2264621103.exe
2848	winupsecvmgr.exe
2848	winupsecvmgr.exe
3644	powershell.exe
3644	powershell.exe
2848	winupsecvmgr.exe
2848	winupsecvmgr.exe
2848	winupsecvmgr.exe
2848	winupsecvmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3536	2277412582.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeSystemEnvironmentPrivilege	3708	powershell.exe
Token: SeRemoteShutdownPrivilege	3708	powershell.exe
Token: SeUndockPrivilege	3708	powershell.exe
Token: SeManageVolumePrivilege	3708	powershell.exe
Token: 33	3708	powershell.exe
Token: 34	3708	powershell.exe
Token: 35	3708	powershell.exe
Token: 36	3708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeSystemEnvironmentPrivilege	3708	powershell.exe
Token: SeRemoteShutdownPrivilege	3708	powershell.exe
Token: SeUndockPrivilege	3708	powershell.exe
Token: SeManageVolumePrivilege	3708	powershell.exe
Token: 33	3708	powershell.exe
Token: 34	3708	powershell.exe
Token: 35	3708	powershell.exe
Token: 36	3708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeSystemEnvironmentPrivilege	3708	powershell.exe
Token: SeRemoteShutdownPrivilege	3708	powershell.exe
Token: SeUndockPrivilege	3708	powershell.exe
Token: SeManageVolumePrivilege	3708	powershell.exe
Token: 33	3708	powershell.exe
Token: 34	3708	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2348	2420	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe	84
PID 2420 wrote to memory of 2348	2420	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe	84
PID 2420 wrote to memory of 2348	2420	03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe	84
PID 2348 wrote to memory of 1188	2348	80C9.exe	93
PID 2348 wrote to memory of 1188	2348	80C9.exe	93
PID 2348 wrote to memory of 1188	2348	80C9.exe	93
PID 1188 wrote to memory of 3220	1188	3017714562.exe	95
PID 1188 wrote to memory of 3220	1188	3017714562.exe	95
PID 1188 wrote to memory of 3220	1188	3017714562.exe	95
PID 3220 wrote to memory of 5028	3220	sysppvrdnvs.exe	98
PID 3220 wrote to memory of 5028	3220	sysppvrdnvs.exe	98
PID 3220 wrote to memory of 5028	3220	sysppvrdnvs.exe	98
PID 3220 wrote to memory of 2000	3220	sysppvrdnvs.exe	100
PID 3220 wrote to memory of 2000	3220	sysppvrdnvs.exe	100
PID 3220 wrote to memory of 2000	3220	sysppvrdnvs.exe	100
PID 5028 wrote to memory of 4040	5028	cmd.exe	102
PID 5028 wrote to memory of 4040	5028	cmd.exe	102
PID 5028 wrote to memory of 4040	5028	cmd.exe	102
PID 2000 wrote to memory of 1656	2000	cmd.exe	103
PID 2000 wrote to memory of 1656	2000	cmd.exe	103
PID 2000 wrote to memory of 1656	2000	cmd.exe	103
PID 2000 wrote to memory of 1748	2000	cmd.exe	104
PID 2000 wrote to memory of 1748	2000	cmd.exe	104
PID 2000 wrote to memory of 1748	2000	cmd.exe	104
PID 2000 wrote to memory of 1252	2000	cmd.exe	105
PID 2000 wrote to memory of 1252	2000	cmd.exe	105
PID 2000 wrote to memory of 1252	2000	cmd.exe	105
PID 2000 wrote to memory of 4208	2000	cmd.exe	106
PID 2000 wrote to memory of 4208	2000	cmd.exe	106
PID 2000 wrote to memory of 4208	2000	cmd.exe	106
PID 2000 wrote to memory of 4212	2000	cmd.exe	107
PID 2000 wrote to memory of 4212	2000	cmd.exe	107
PID 2000 wrote to memory of 4212	2000	cmd.exe	107
PID 3220 wrote to memory of 3536	3220	sysppvrdnvs.exe	112
PID 3220 wrote to memory of 3536	3220	sysppvrdnvs.exe	112
PID 3536 wrote to memory of 1880	3536	2277412582.exe	113
PID 3536 wrote to memory of 1880	3536	2277412582.exe	113
PID 3536 wrote to memory of 1760	3536	2277412582.exe	115
PID 3536 wrote to memory of 1760	3536	2277412582.exe	115
PID 1880 wrote to memory of 1624	1880	cmd.exe	117
PID 1880 wrote to memory of 1624	1880	cmd.exe	117
PID 1760 wrote to memory of 2348	1760	cmd.exe	118
PID 1760 wrote to memory of 2348	1760	cmd.exe	118
PID 3220 wrote to memory of 452	3220	sysppvrdnvs.exe	119
PID 3220 wrote to memory of 452	3220	sysppvrdnvs.exe	119
PID 3220 wrote to memory of 452	3220	sysppvrdnvs.exe	119
PID 3220 wrote to memory of 3508	3220	sysppvrdnvs.exe	120
PID 3220 wrote to memory of 3508	3220	sysppvrdnvs.exe	120
PID 3220 wrote to memory of 3508	3220	sysppvrdnvs.exe	120
PID 3508 wrote to memory of 4764	3508	1652927828.exe	121
PID 3508 wrote to memory of 4764	3508	1652927828.exe	121
PID 3220 wrote to memory of 3484	3220	sysppvrdnvs.exe	125
PID 3220 wrote to memory of 3484	3220	sysppvrdnvs.exe	125
PID 3220 wrote to memory of 3484	3220	sysppvrdnvs.exe	125
PID 2848 wrote to memory of 980	2848	winupsecvmgr.exe	133
PID 2848 wrote to memory of 3756	2848	winupsecvmgr.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3416
- C:\Users\Admin\AppData\Local\Temp\03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe
  "C:\Users\Admin\AppData\Local\Temp\03b16b9e811ea1555088c297c76c2db0f29ba2a033bb8372dc53ed55145b0ba0N.exe"
  2⤵
  - Checks BIOS information in registry
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\80C9.exe
    "C:\Users\Admin\AppData\Local\Temp\80C9.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\3017714562.exe
      C:\Users\Admin\AppData\Local\Temp\3017714562.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Windows\sysppvrdnvs.exe
        
        C:\Windows\sysppvrdnvs.exe
        5⤵
        Modifies security service
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\2277412582.exe
        
        C:\Users\Admin\AppData\Local\Temp\2277412582.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:1624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\46903692.exe
        
        C:\Users\Admin\AppData\Local\Temp\46903692.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\1652927828.exe
        
        C:\Users\Admin\AppData\Local\Temp\1652927828.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\2264621103.exe
        
        C:\Users\Admin\AppData\Local\Temp\2264621103.exe
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\105918889.exe
        
        C:\Users\Admin\AppData\Local\Temp\105918889.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:980
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  PID:3756

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

System Information Discovery