quasar | fe894016f94b60553d9138137f52578c6433fd74a73ad89ab8b44557fc0c3325

System Information Discovery

Processes:

BURPSU~1.EXE

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	BURPSU~1.EXE

Executes dropped EXE 5 IoCs

Processes:

burpsuite2.2.3.EXEBUPSUI~1.EXEsvhostt.exeBURPSU~1.EXEjava.exe

pid	Process
3148	burpsuite2.2.3.EXE
2736	BUPSUI~1.EXE
4008	svhostt.exe
4956	BURPSU~1.EXE
548	java.exe

Loads dropped DLL 25 IoCs

Processes:

java.exeBURPSU~1.EXE

pid	Process
548	java.exe
548	java.exe
548	java.exe
548	java.exe
548	java.exe
548	java.exe
548	java.exe
548	java.exe
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

burpsuite2.2.3.EXE

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	burpsuite2.2.3.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
36	ip-api.com

Drops file in Program Files directory 64 IoCs

Processes:

BURPSU~1.EXE

description	ioc	Process
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j14800668341020269510.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\harfbuzz.dll	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.desktop\i4j18163464307273066449.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.management.rmi\ADDITIONAL_LICENSE_INFO	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.naming\i4j11290392777425194774.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j15361105923472749286.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\api-ms-win-core-handle-l1-1-0.dll	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j9095430752071967090.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\lib\i4j7692021670209383148.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.naming\i4j15627039436652255516.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.sql\i4j12683579429384887783.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml\i4j12567837698104621791.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.prefs\i4j17364990097773657739.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j17413686302819221140.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\jimage.dll	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j11351618248816627209.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j2936628735615410922.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.security.sasl\ASSEMBLY_EXCEPTION	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\lib\security\i4j10173312327146069420.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.rmi\i4j16460403537815580095.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.transaction.xa\i4j360966367263179619.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml\i4j15844225003754537202.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.accessibility\i4j14177775287325930609.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\BurpSuiteCommunity.vmoptions	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j12991611520322261674.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j10180969197378378294.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.management\LICENSE	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j13018553180600581247.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\include\jni.h	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.security.auth\i4j5310638017174526179.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\api-ms-win-core-string-l1-1-0.dll	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j5638310551004003049.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.mscapi\i4j10333432347003795525.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j623194822031298226.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j12400722404576811559.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\lib\i4j12038440899570594988.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.instrument\i4j10510398839654749710.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.transaction.xa\i4j6092375630770786025.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml\jcup.md	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.ec\i4j15511164297319599546.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.ec\i4j12420706418059621453.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j6482851968663323075.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\splashscreen.dll	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.base\i4j8872914148878622814.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\lib\i4j9091218923357348634.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.accessibility\i4j5339543235889231003.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\lib\i4j12038440899570594988.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\conf\security\policy\limited\i4j1947005698973234291.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.net.http\i4j327121430091281961.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.sql\LICENSE	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.desktop\jpeg.md	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j16474893032632242839.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\include\win32\bridge\i4j11247089672176173176.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.base\i4j17657225933451688861.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.datatransfer\i4j13492825399831528559.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.scripting\LICENSE	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.security.jgss\LICENSE	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.zipfs\i4j178781774984148026.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j14799727172339813683.tmp	BURPSU~1.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j761649406593267010.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\include\i4j15627681114759633126.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\i4j2707656119778558386.tmp	BURPSU~1.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml.crypto\santuario.md	BURPSU~1.EXE

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeBUPSUI~1.EXEschtasks.exesvhostt.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUPSUI~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhostt.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

java.exeBURPSU~1.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BURPSU~1.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	BURPSU~1.EXE

Modifies registry class 1 IoCs

Processes:

7zFM.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	7zFM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exe

pid	Process
2836	schtasks.exe
4248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

7zFM.exetaskmgr.exeBURPSU~1.EXE

pid	Process
4792	7zFM.exe
4792	7zFM.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
4792	7zFM.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

7zFM.exeBUPSUI~1.EXEsvhostt.exetaskmgr.exeBURPSU~1.EXE

description	pid	Process
Token: SeRestorePrivilege	4792	7zFM.exe
Token: 35	4792	7zFM.exe
Token: SeSecurityPrivilege	4792	7zFM.exe
Token: SeSecurityPrivilege	4792	7zFM.exe
Token: SeSecurityPrivilege	4792	7zFM.exe
Token: SeDebugPrivilege	2736	BUPSUI~1.EXE
Token: SeDebugPrivilege	4008	svhostt.exe
Token: SeDebugPrivilege	2088	taskmgr.exe
Token: SeSystemProfilePrivilege	2088	taskmgr.exe
Token: SeCreateGlobalPrivilege	2088	taskmgr.exe
Token: 33	2088	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2088	taskmgr.exe
Token: SeDebugPrivilege	4956	BURPSU~1.EXE

Suspicious use of FindShellTrayWindow 47 IoCs

Processes:

7zFM.exetaskmgr.exeBURPSU~1.EXE

pid	Process
4792	7zFM.exe
4792	7zFM.exe
4792	7zFM.exe
4792	7zFM.exe
4792	7zFM.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

taskmgr.exe

pid	Process
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe
2088	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

svhostt.exeBURPSU~1.EXE

pid	Process
4008	svhostt.exe
4956	BURPSU~1.EXE
4956	BURPSU~1.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

7zFM.exeburpsuite2.2.3.EXEBUPSUI~1.EXEsvhostt.exeBURPSU~1.EXE

description	pid	Process	procid_target
PID 4792 wrote to memory of 920	4792	7zFM.exe	101
PID 4792 wrote to memory of 920	4792	7zFM.exe	101
PID 4792 wrote to memory of 3148	4792	7zFM.exe	102
PID 4792 wrote to memory of 3148	4792	7zFM.exe	102
PID 3148 wrote to memory of 2736	3148	burpsuite2.2.3.EXE	105
PID 3148 wrote to memory of 2736	3148	burpsuite2.2.3.EXE	105
PID 3148 wrote to memory of 2736	3148	burpsuite2.2.3.EXE	105
PID 2736 wrote to memory of 4248	2736	BUPSUI~1.EXE	107
PID 2736 wrote to memory of 4248	2736	BUPSUI~1.EXE	107
PID 2736 wrote to memory of 4248	2736	BUPSUI~1.EXE	107
PID 2736 wrote to memory of 4008	2736	BUPSUI~1.EXE	109
PID 2736 wrote to memory of 4008	2736	BUPSUI~1.EXE	109
PID 2736 wrote to memory of 4008	2736	BUPSUI~1.EXE	109
PID 4008 wrote to memory of 2836	4008	svhostt.exe	112
PID 4008 wrote to memory of 2836	4008	svhostt.exe	112
PID 4008 wrote to memory of 2836	4008	svhostt.exe	112
PID 3148 wrote to memory of 4956	3148	burpsuite2.2.3.EXE	110
PID 3148 wrote to memory of 4956	3148	burpsuite2.2.3.EXE	110
PID 4956 wrote to memory of 548	4956	BURPSU~1.EXE	114
PID 4956 wrote to memory of 548	4956	BURPSU~1.EXE	114

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\burppack3-2024.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8B2BB878\Read-me.txt
  2⤵
  PID:920
- C:\Users\Admin\AppData\Local\Temp\7zO8B241948\burpsuite2.2.3.EXE
  "C:\Users\Admin\AppData\Local\Temp\7zO8B241948\burpsuite2.2.3.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUPSUI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUPSUI~1.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "svhostt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUPSUI~1.EXE" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4248
  - - C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "svhostt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2836
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~1.EXE
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - \??\c:\users\admin\appdata\local\temp\E4J909~1.TMP\jre\bin\java.exe
      c:\users\admin\appdata\local\temp\E4J909~1.TMP\jre\bin\java.exe -version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery