xworm | 1670b4755805f0d523fba188435da1357c62562153db2b8fa5743ab9906e2c54

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3406519639-3774642266-3926631722-1000\Control Panel\International\Geo\Nation	ASpoofer.exe

Executes dropped EXE 1 IoCs

pid	Process
2924	ibje53j4.us4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406519639-3774642266-3926631722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ASpoofer = "C:\\ProgramData\\ASpoofer.exe"	ASpoofer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\MasonASpoofer.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C010CA0DBAE5"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2352	SCHTASKS.exe
3780	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
656	svchost.exe
656	svchost.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2504	wlrmdr.exe
2924	ibje53j4.us4.exe
2504	wlrmdr.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe
2924	ibje53j4.us4.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2504	wlrmdr.exe
3592	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	ASpoofer.exe
Token: SeDebugPrivilege	2924	ibje53j4.us4.exe
Token: SeShutdownPrivilege	1076	dwm.exe
Token: SeCreatePagefilePrivilege	1076	dwm.exe
Token: SeShutdownPrivilege	3592	Explorer.EXE
Token: SeCreatePagefilePrivilege	3592	Explorer.EXE
Token: SeShutdownPrivilege	3592	Explorer.EXE
Token: SeCreatePagefilePrivilege	3592	Explorer.EXE
Token: SeShutdownPrivilege	3592	Explorer.EXE
Token: SeCreatePagefilePrivilege	3592	Explorer.EXE
Token: SeShutdownPrivilege	3592	Explorer.EXE
Token: SeCreatePagefilePrivilege	3592	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2504	wlrmdr.exe
2036	Conhost.exe
4012	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2924	4032	ASpoofer.exe	82
PID 4032 wrote to memory of 2924	4032	ASpoofer.exe	82
PID 4032 wrote to memory of 2352	4032	ASpoofer.exe	83
PID 4032 wrote to memory of 2352	4032	ASpoofer.exe	83
PID 2924 wrote to memory of 616	2924	ibje53j4.us4.exe	5
PID 2924 wrote to memory of 704	2924	ibje53j4.us4.exe	7
PID 2924 wrote to memory of 988	2924	ibje53j4.us4.exe	12
PID 704 wrote to memory of 2760	704	lsass.exe	47
PID 2924 wrote to memory of 500	2924	ibje53j4.us4.exe	13
PID 2924 wrote to memory of 416	2924	ibje53j4.us4.exe	14
PID 2924 wrote to memory of 724	2924	ibje53j4.us4.exe	15
PID 2924 wrote to memory of 736	2924	ibje53j4.us4.exe	16
PID 2924 wrote to memory of 1076	2924	ibje53j4.us4.exe	17
PID 2924 wrote to memory of 1100	2924	ibje53j4.us4.exe	18
PID 2924 wrote to memory of 1124	2924	ibje53j4.us4.exe	19
PID 2924 wrote to memory of 1196	2924	ibje53j4.us4.exe	20
PID 2924 wrote to memory of 1312	2924	ibje53j4.us4.exe	22
PID 2924 wrote to memory of 1380	2924	ibje53j4.us4.exe	23
PID 704 wrote to memory of 2760	704	lsass.exe	47
PID 2924 wrote to memory of 1404	2924	ibje53j4.us4.exe	24
PID 2924 wrote to memory of 1420	2924	ibje53j4.us4.exe	25
PID 2924 wrote to memory of 1488	2924	ibje53j4.us4.exe	26
PID 2924 wrote to memory of 1548	2924	ibje53j4.us4.exe	27
PID 2924 wrote to memory of 1652	2924	ibje53j4.us4.exe	28
PID 2924 wrote to memory of 1692	2924	ibje53j4.us4.exe	29
PID 2924 wrote to memory of 1712	2924	ibje53j4.us4.exe	30
PID 2924 wrote to memory of 1756	2924	ibje53j4.us4.exe	31
PID 2924 wrote to memory of 1852	2924	ibje53j4.us4.exe	32
PID 2924 wrote to memory of 1912	2924	ibje53j4.us4.exe	33
PID 2924 wrote to memory of 1940	2924	ibje53j4.us4.exe	34
PID 2924 wrote to memory of 1948	2924	ibje53j4.us4.exe	35
PID 2924 wrote to memory of 1156	2924	ibje53j4.us4.exe	36
PID 2924 wrote to memory of 1728	2924	ibje53j4.us4.exe	37
PID 2924 wrote to memory of 2128	2924	ibje53j4.us4.exe	38
PID 2924 wrote to memory of 2264	2924	ibje53j4.us4.exe	40
PID 2924 wrote to memory of 2364	2924	ibje53j4.us4.exe	41
PID 2924 wrote to memory of 2416	2924	ibje53j4.us4.exe	42
PID 2924 wrote to memory of 2424	2924	ibje53j4.us4.exe	43
PID 2924 wrote to memory of 2548	2924	ibje53j4.us4.exe	44
PID 2924 wrote to memory of 2656	2924	ibje53j4.us4.exe	45
PID 2924 wrote to memory of 2744	2924	ibje53j4.us4.exe	46
PID 2924 wrote to memory of 2760	2924	ibje53j4.us4.exe	47
PID 704 wrote to memory of 2760	704	lsass.exe	47
PID 2924 wrote to memory of 2792	2924	ibje53j4.us4.exe	48
PID 2924 wrote to memory of 2800	2924	ibje53j4.us4.exe	49
PID 2924 wrote to memory of 3068	2924	ibje53j4.us4.exe	50
PID 2924 wrote to memory of 3196	2924	ibje53j4.us4.exe	52
PID 2924 wrote to memory of 3212	2924	ibje53j4.us4.exe	53
PID 2924 wrote to memory of 3300	2924	ibje53j4.us4.exe	54
PID 2924 wrote to memory of 3356	2924	ibje53j4.us4.exe	55
PID 2924 wrote to memory of 3496	2924	ibje53j4.us4.exe	56
PID 2924 wrote to memory of 3592	2924	ibje53j4.us4.exe	57
PID 2924 wrote to memory of 3692	2924	ibje53j4.us4.exe	58
PID 2924 wrote to memory of 3996	2924	ibje53j4.us4.exe	60
PID 2924 wrote to memory of 4156	2924	ibje53j4.us4.exe	62
PID 2924 wrote to memory of 4368	2924	ibje53j4.us4.exe	63
PID 2924 wrote to memory of 3612	2924	ibje53j4.us4.exe	65
PID 2924 wrote to memory of 4252	2924	ibje53j4.us4.exe	67
PID 2924 wrote to memory of 1964	2924	ibje53j4.us4.exe	68
PID 2924 wrote to memory of 2960	2924	ibje53j4.us4.exe	69
PID 2924 wrote to memory of 2000	2924	ibje53j4.us4.exe	70
PID 2924 wrote to memory of 3260	2924	ibje53j4.us4.exe	71
PID 2924 wrote to memory of 3868	2924	ibje53j4.us4.exe	72
PID 2924 wrote to memory of 3944	2924	ibje53j4.us4.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\system32\wlrmdr.exe
  -s -1 -f 2 -t Your PC will automatically restart in one minute -m Windows ran into a problem and needs to restart. You should close this message now and save your work. -a 3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 704 -s 4744
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1312
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3300
- C:\Windows\system32\MusNotification.exe
  "C:\Windows\system32\MusNotification.exe"
  2⤵
  PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1548
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1728

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2744

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2800

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3496

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3592
- C:\Users\Admin\AppData\Local\Temp\ASpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\ASpoofer.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\ibje53j4.us4.exe
    "C:\Users\Admin\AppData\Local\Temp\ibje53j4.us4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonASpoofer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ASpoofer.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonASpoofer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ASpoofer.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ASpoofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    PID:4460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ASpoofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    PID:3968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\ASpoofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    PID:1780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4156

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1964

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2960

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1236

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:3760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery