991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
Size 7.8MB
Sample260719-3p4fwsbs7w
SHA256 991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd
MD5 9c31fe73455f22cf758994e0aa6bb85c
SHA1 ce13d1f68c3a2138d1eeeae54901ddbabcc4f1ae
SHA512 ccf0d878f73fd605a3831914224d774db611cf390c2ca0d2f2011b7583061667d59c388ab6d311f2036b6e55587665638d20f45869605efc366d1984290a176e
SSDEEP 196608:/mDUOW88ExD42wqlTPLGl/QQ+WHxY0P/hAeaCJJd72/5zpsFly+mqt8+G3Zfmz0Q:/mDUOWDExE2weTPLHGIMR
TLSH
T1E086F107ACB000AAD0399773A9F770D6AA65B8A8573333C35F52F3791EB16D12A72315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 42 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2608	powershell.exe
4992	powershell.exe
1820	powershell.exe
5824	powershell.exe
3100	powershell.exe
3044	powershell.exe
2368	powershell.exe
2400	powershell.exe
688	powershell.exe
4908	powershell.exe
5100	powershell.exe
5092	powershell.exe
4088	powershell.exe
2192	powershell.exe
2080	powershell.exe
52	powershell.exe
1320	powershell.exe
612	powershell.exe
6024	powershell.exe
5364	powershell.exe
2900	powershell.exe
3044	powershell.exe
6024	powershell.exe
5364	powershell.exe
4088	powershell.exe
2608	powershell.exe
2400	powershell.exe
4992	powershell.exe
4908	powershell.exe
52	powershell.exe
612	powershell.exe
1820	powershell.exe
2368	powershell.exe
688	powershell.exe
5100	powershell.exe
5092	powershell.exe
5824	powershell.exe
3100	powershell.exe
2192	powershell.exe
2080	powershell.exe
2900	powershell.exe
1320	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5704	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe"	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecddRoaming = "C:\\Users\\Admin\\AppData\\Roaming\\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe"	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	12	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
2368	powershell.exe
3100	powershell.exe
3100	powershell.exe
2368	powershell.exe
2192	powershell.exe
2192	powershell.exe
2608	powershell.exe
2608	powershell.exe
3100	powershell.exe
2400	powershell.exe
2400	powershell.exe
688	powershell.exe
688	powershell.exe
4088	powershell.exe
2368	powershell.exe
2192	powershell.exe
2608	powershell.exe
688	powershell.exe
2400	powershell.exe
2900	powershell.exe
2900	powershell.exe
2080	powershell.exe
2080	powershell.exe
4908	powershell.exe
4908	powershell.exe
4992	powershell.exe
4992	powershell.exe
5100	powershell.exe
5100	powershell.exe
1820	powershell.exe
1820	powershell.exe
2900	powershell.exe
5364	powershell.exe
5364	powershell.exe
5100	powershell.exe
2080	powershell.exe
2080	powershell.exe
4992	powershell.exe
4992	powershell.exe
4908	powershell.exe
4908	powershell.exe
6024	powershell.exe
6024	powershell.exe
612	powershell.exe
612	powershell.exe
52	powershell.exe
52	powershell.exe
1820	powershell.exe
1820	powershell.exe
5364	powershell.exe
5364	powershell.exe
5092	powershell.exe
5092	powershell.exe
3044	powershell.exe
3044	powershell.exe
1320	powershell.exe
1320	powershell.exe
5824	powershell.exe
5824	powershell.exe
6024	powershell.exe
52	powershell.exe
612	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeIncreaseQuotaPrivilege	3100	powershell.exe
Token: SeSecurityPrivilege	3100	powershell.exe
Token: SeTakeOwnershipPrivilege	3100	powershell.exe
Token: SeLoadDriverPrivilege	3100	powershell.exe
Token: SeSystemProfilePrivilege	3100	powershell.exe
Token: SeSystemtimePrivilege	3100	powershell.exe
Token: SeProfSingleProcessPrivilege	3100	powershell.exe
Token: SeIncBasePriorityPrivilege	3100	powershell.exe
Token: SeCreatePagefilePrivilege	3100	powershell.exe
Token: SeBackupPrivilege	3100	powershell.exe
Token: SeRestorePrivilege	3100	powershell.exe
Token: SeShutdownPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeSystemEnvironmentPrivilege	3100	powershell.exe
Token: SeRemoteShutdownPrivilege	3100	powershell.exe
Token: SeUndockPrivilege	3100	powershell.exe
Token: SeManageVolumePrivilege	3100	powershell.exe
Token: 33	3100	powershell.exe
Token: 34	3100	powershell.exe
Token: 35	3100	powershell.exe
Token: 36	3100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2192	powershell.exe
Token: SeSecurityPrivilege	2192	powershell.exe
Token: SeTakeOwnershipPrivilege	2192	powershell.exe
Token: SeLoadDriverPrivilege	2192	powershell.exe
Token: SeSystemProfilePrivilege	2192	powershell.exe
Token: SeSystemtimePrivilege	2192	powershell.exe
Token: SeProfSingleProcessPrivilege	2192	powershell.exe
Token: SeIncBasePriorityPrivilege	2192	powershell.exe
Token: SeCreatePagefilePrivilege	2192	powershell.exe
Token: SeBackupPrivilege	2192	powershell.exe
Token: SeRestorePrivilege	2192	powershell.exe
Token: SeShutdownPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeSystemEnvironmentPrivilege	2192	powershell.exe
Token: SeRemoteShutdownPrivilege	2192	powershell.exe
Token: SeUndockPrivilege	2192	powershell.exe
Token: SeManageVolumePrivilege	2192	powershell.exe
Token: 33	2192	powershell.exe
Token: 34	2192	powershell.exe
Token: 35	2192	powershell.exe
Token: 36	2192	powershell.exe
Token: SeIncreaseQuotaPrivilege	2608	powershell.exe
Token: SeSecurityPrivilege	2608	powershell.exe
Token: SeTakeOwnershipPrivilege	2608	powershell.exe
Token: SeLoadDriverPrivilege	2608	powershell.exe
Token: SeSystemProfilePrivilege	2608	powershell.exe
Token: SeSystemtimePrivilege	2608	powershell.exe
Token: SeProfSingleProcessPrivilege	2608	powershell.exe
Token: SeIncBasePriorityPrivilege	2608	powershell.exe
Token: SeCreatePagefilePrivilege	2608	powershell.exe
Token: SeBackupPrivilege	2608	powershell.exe
Token: SeRestorePrivilege	2608	powershell.exe
Token: SeShutdownPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeSystemEnvironmentPrivilege	2608	powershell.exe
Token: SeRemoteShutdownPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4088	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	88
PID 5960 wrote to memory of 2368	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	89
PID 5960 wrote to memory of 3100	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	91
PID 5960 wrote to memory of 2192	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	93
PID 5960 wrote to memory of 2608	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	96
PID 5960 wrote to memory of 2400	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	98
PID 5960 wrote to memory of 688	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	100
PID 5960 wrote to memory of 5704	5960	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	104
PID 3604 wrote to memory of 2900	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	109
PID 3604 wrote to memory of 2080	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	110
PID 3604 wrote to memory of 4992	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	113
PID 3604 wrote to memory of 4908	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	114
PID 3604 wrote to memory of 1820	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	116
PID 3604 wrote to memory of 5100	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	118
PID 3604 wrote to memory of 5364	3604	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	120
PID 1040 wrote to memory of 6024	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	124
PID 1040 wrote to memory of 612	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	125
PID 1040 wrote to memory of 52	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	127
PID 1040 wrote to memory of 5092	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	130
PID 1040 wrote to memory of 1320	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	131
PID 1040 wrote to memory of 3044	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	134
PID 1040 wrote to memory of 5824	1040	991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe	136

C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
"C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=S_19099 dir=in action=allow protocol=TCP localport=19099
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5704

C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5364

C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:52
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\991bc33adf6e07583c78140bc589c1eeee1d53748055c3c70d5b03f65539ecdd.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact