phorphiex | ff439c4df17f9cf699f9687225447b526713f0046c7c78412dba5b8bfd37d741

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sysvokf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	sysvokf.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysblvrvcr.exe

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001e67a-4.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 3108 created 3456	3108	2314614664.exe	56
PID 3108 created 3456	3108	2314614664.exe	56
PID 4848 created 3456	4848	winupsecvmgr.exe	56
PID 4848 created 3456	4848	winupsecvmgr.exe	56
PID 4848 created 3456	4848	winupsecvmgr.exe	56

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysblvrvcr.exe

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/4848-183-0x00007FF7F29D0000-0x00007FF7F2F67000-memory.dmp	xmrig
behavioral2/memory/4332-186-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig
behavioral2/memory/4332-188-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig
behavioral2/memory/4332-190-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig
behavioral2/memory/4332-192-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig
behavioral2/memory/4332-195-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig
behavioral2/memory/4332-197-0x00007FF7F3EE0000-0x00007FF7F46CF000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4444	powershell.exe
4672	powershell.exe
5096	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	232746143.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sysblvrvcr.exe

Executes dropped EXE 10 IoCs

pid	Process
5036	24673.exe
3760	sysblvrvcr.exe
1796	12218.exe
1996	19958.exe
1004	232746143.exe
3708	1593830024.exe
3888	1964321340.exe
3108	2314614664.exe
1776	155912450.exe
4848	winupsecvmgr.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvokf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysblvrvcr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysblvrvcr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysblvrvcr.exe"	24673.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4848 set thread context of 4108	4848	winupsecvmgr.exe	143
PID 4848 set thread context of 4332	4848	winupsecvmgr.exe	144

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysblvrvcr.exe	24673.exe
File created	C:\Windows\sysblvrvcr.exe	24673.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3096	sc.exe
4568	sc.exe
904	sc.exe
2036	sc.exe
708	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysblvrvcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1593830024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvokf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	155912450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1964321340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
4208	sysvokf.exe
5096	powershell.exe
5096	powershell.exe
1004	232746143.exe
3108	2314614664.exe
3108	2314614664.exe
4672	powershell.exe
4672	powershell.exe
3108	2314614664.exe
3108	2314614664.exe
4848	winupsecvmgr.exe
4848	winupsecvmgr.exe
4444	powershell.exe
4444	powershell.exe
4848	winupsecvmgr.exe
4848	winupsecvmgr.exe
4848	winupsecvmgr.exe
4848	winupsecvmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	sysvokf.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	1004	232746143.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe
4332	dwm.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 5036	4208	sysvokf.exe	107
PID 4208 wrote to memory of 5036	4208	sysvokf.exe	107
PID 4208 wrote to memory of 5036	4208	sysvokf.exe	107
PID 5036 wrote to memory of 3760	5036	24673.exe	108
PID 5036 wrote to memory of 3760	5036	24673.exe	108
PID 5036 wrote to memory of 3760	5036	24673.exe	108
PID 3760 wrote to memory of 1448	3760	sysblvrvcr.exe	109
PID 3760 wrote to memory of 1448	3760	sysblvrvcr.exe	109
PID 3760 wrote to memory of 1448	3760	sysblvrvcr.exe	109
PID 3760 wrote to memory of 4848	3760	sysblvrvcr.exe	111
PID 3760 wrote to memory of 4848	3760	sysblvrvcr.exe	111
PID 3760 wrote to memory of 4848	3760	sysblvrvcr.exe	111
PID 1448 wrote to memory of 5096	1448	cmd.exe	113
PID 1448 wrote to memory of 5096	1448	cmd.exe	113
PID 1448 wrote to memory of 5096	1448	cmd.exe	113
PID 4848 wrote to memory of 3096	4848	cmd.exe	114
PID 4848 wrote to memory of 3096	4848	cmd.exe	114
PID 4848 wrote to memory of 3096	4848	cmd.exe	114
PID 4848 wrote to memory of 4568	4848	cmd.exe	115
PID 4848 wrote to memory of 4568	4848	cmd.exe	115
PID 4848 wrote to memory of 4568	4848	cmd.exe	115
PID 4848 wrote to memory of 904	4848	cmd.exe	116
PID 4848 wrote to memory of 904	4848	cmd.exe	116
PID 4848 wrote to memory of 904	4848	cmd.exe	116
PID 4848 wrote to memory of 2036	4848	cmd.exe	117
PID 4848 wrote to memory of 2036	4848	cmd.exe	117
PID 4848 wrote to memory of 2036	4848	cmd.exe	117
PID 4848 wrote to memory of 708	4848	cmd.exe	118
PID 4848 wrote to memory of 708	4848	cmd.exe	118
PID 4848 wrote to memory of 708	4848	cmd.exe	118
PID 4208 wrote to memory of 1796	4208	sysvokf.exe	119
PID 4208 wrote to memory of 1796	4208	sysvokf.exe	119
PID 4208 wrote to memory of 1796	4208	sysvokf.exe	119
PID 4208 wrote to memory of 1996	4208	sysvokf.exe	120
PID 4208 wrote to memory of 1996	4208	sysvokf.exe	120
PID 4208 wrote to memory of 1996	4208	sysvokf.exe	120
PID 3760 wrote to memory of 1004	3760	sysblvrvcr.exe	124
PID 3760 wrote to memory of 1004	3760	sysblvrvcr.exe	124
PID 1004 wrote to memory of 1960	1004	232746143.exe	125
PID 1004 wrote to memory of 1960	1004	232746143.exe	125
PID 1004 wrote to memory of 1932	1004	232746143.exe	127
PID 1004 wrote to memory of 1932	1004	232746143.exe	127
PID 1960 wrote to memory of 4828	1960	cmd.exe	129
PID 1960 wrote to memory of 4828	1960	cmd.exe	129
PID 1932 wrote to memory of 4276	1932	cmd.exe	130
PID 1932 wrote to memory of 4276	1932	cmd.exe	130
PID 3760 wrote to memory of 3708	3760	sysblvrvcr.exe	131
PID 3760 wrote to memory of 3708	3760	sysblvrvcr.exe	131
PID 3760 wrote to memory of 3708	3760	sysblvrvcr.exe	131
PID 3760 wrote to memory of 3888	3760	sysblvrvcr.exe	132
PID 3760 wrote to memory of 3888	3760	sysblvrvcr.exe	132
PID 3760 wrote to memory of 3888	3760	sysblvrvcr.exe	132
PID 3888 wrote to memory of 3108	3888	1964321340.exe	133
PID 3888 wrote to memory of 3108	3888	1964321340.exe	133
PID 3760 wrote to memory of 1776	3760	sysblvrvcr.exe	134
PID 3760 wrote to memory of 1776	3760	sysblvrvcr.exe	134
PID 3760 wrote to memory of 1776	3760	sysblvrvcr.exe	134
PID 4848 wrote to memory of 4108	4848	winupsecvmgr.exe	143
PID 4848 wrote to memory of 4332	4848	winupsecvmgr.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\sysvokf.exe
  "C:\Users\Admin\AppData\Local\Temp\sysvokf.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\24673.exe
    C:\Users\Admin\AppData\Local\Temp\24673.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\sysblvrvcr.exe
      C:\Windows\sysblvrvcr.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1448
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4848
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4568
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:904
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2036
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\232746143.exe
        
        C:\Users\Admin\AppData\Local\Temp\232746143.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:4828
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\1593830024.exe
        
        C:\Users\Admin\AppData\Local\Temp\1593830024.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\1964321340.exe
        
        C:\Users\Admin\AppData\Local\Temp\1964321340.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\2314614664.exe
        
        C:\Users\Admin\AppData\Local\Temp\2314614664.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\155912450.exe
        
        C:\Users\Admin\AppData\Local\Temp\155912450.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1776
- - C:\Users\Admin\AppData\Local\Temp\12218.exe
    C:\Users\Admin\AppData\Local\Temp\12218.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\19958.exe
    C:\Users\Admin\AppData\Local\Temp\19958.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:4108
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4332

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry