b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	xhopeless.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xhopeless.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xhopeless.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	xhopeless.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	xhopeless.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "1"	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "1"	xhopeless.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	xhopeless.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Explorer.EXE
File opened (read-only)	\??\F:	Explorer.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	xhopeless.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winload.efi	xhopeless.exe
File opened for modification	C:\Windows\System32\winresume.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\winresume.efi	xhopeless.exe
File opened for modification	C:\Windows\System32\bootmgfw.efi	xhopeless.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\Boot\winload.efi	xhopeless.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\bootsuppl.dll	xhopeless.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\driver.stl	xhopeless.exe
File opened for modification	C:\Windows\System32\winload.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\bootsect.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\ntkrnlmp.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\Boot\winload.exe	xhopeless.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
828	cmd.exe
5992	cmd.exe
5752	cmd.exe
5772	cmd.exe
2908	cmd.exe
5480	cmd.exe
1084	cmd.exe
3080	cmd.exe
4524	cmd.exe
4816	cmd.exe
1248	cmd.exe
3144	cmd.exe
4476	cmd.exe
3920	cmd.exe
4632	cmd.exe
3064	cmd.exe
1940	cmd.exe
4284	cmd.exe
4460	cmd.exe
2620	cmd.exe
3296	cmd.exe
5688	cmd.exe
2144	cmd.exe
5152	cmd.exe
1920	cmd.exe
2820	cmd.exe
4484	cmd.exe
3308	cmd.exe
5900	cmd.exe
3084	cmd.exe
6072	cmd.exe
4388	cmd.exe
52	cmd.exe
1244	cmd.exe
2440	cmd.exe
5164	cmd.exe
4572	cmd.exe
4400	cmd.exe
4540	cmd.exe
1140	cmd.exe
4540	cmd.exe
3848	cmd.exe
5796	cmd.exe
5652	cmd.exe
5864	cmd.exe
1664	cmd.exe
3272	cmd.exe
1256	cmd.exe
4804	cmd.exe
4520	cmd.exe
4544	cmd.exe
2764	cmd.exe
824	cmd.exe
3948	cmd.exe
1596	cmd.exe
3440	cmd.exe
4356	cmd.exe
3924	cmd.exe
3428	cmd.exe
1328	cmd.exe
1540	cmd.exe
5016	cmd.exe
4292	cmd.exe
1256	cmd.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{739353E6-71B0-4FFE-8856-EC6CBACEB05F}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{D6FBAEA6-2C26-46B1-B037-C30A052C3729}	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1556	xhopeless.exe
1556	xhopeless.exe
1556	xhopeless.exe
1556	xhopeless.exe
1556	xhopeless.exe
1556	xhopeless.exe
3232	Explorer.EXE
3232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeSystemtimePrivilege	1556	xhopeless.exe
Token: SeDebugPrivilege	1556	xhopeless.exe
Token: SeBackupPrivilege	1556	xhopeless.exe
Token: SeRestorePrivilege	1556	xhopeless.exe
Token: SeTakeOwnershipPrivilege	1556	xhopeless.exe
Token: SeLoadDriverPrivilege	1556	xhopeless.exe
Token: SeSystemEnvironmentPrivilege	1556	xhopeless.exe
Token: SeShutdownPrivilege	1556	xhopeless.exe
Token: SeShutdownPrivilege	3232	Explorer.EXE
Token: SeCreatePagefilePrivilege	3232	Explorer.EXE
Token: SeShutdownPrivilege	3232	Explorer.EXE
Token: SeCreatePagefilePrivilege	3232	Explorer.EXE
Token: SeShutdownPrivilege	3232	Explorer.EXE
Token: SeCreatePagefilePrivilege	3232	Explorer.EXE
Token: SeShutdownPrivilege	3232	Explorer.EXE
Token: SeCreatePagefilePrivilege	3232	Explorer.EXE
Token: SeShutdownPrivilege	3232	Explorer.EXE
Token: SeCreatePagefilePrivilege	3232	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3232	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4316	1556	xhopeless.exe	90
PID 1556 wrote to memory of 5036	1556	xhopeless.exe	92
PID 1556 wrote to memory of 5408	1556	xhopeless.exe	94
PID 1556 wrote to memory of 4484	1556	xhopeless.exe	96
PID 1556 wrote to memory of 1596	1556	xhopeless.exe	98
PID 1556 wrote to memory of 1700	1556	xhopeless.exe	100
PID 1556 wrote to memory of 3920	1556	xhopeless.exe	102
PID 1556 wrote to memory of 2616	1556	xhopeless.exe	104
PID 1556 wrote to memory of 5632	1556	xhopeless.exe	106
PID 1556 wrote to memory of 4312	1556	xhopeless.exe	108
PID 1556 wrote to memory of 1484	1556	xhopeless.exe	233
PID 1556 wrote to memory of 5776	1556	xhopeless.exe	235
PID 1556 wrote to memory of 3136	1556	xhopeless.exe	237
PID 1556 wrote to memory of 5528	1556	xhopeless.exe	239
PID 1556 wrote to memory of 588	1556	xhopeless.exe	241
PID 1556 wrote to memory of 292	1556	xhopeless.exe	122
PID 1556 wrote to memory of 3308	1556	xhopeless.exe	124
PID 1556 wrote to memory of 2056	1556	xhopeless.exe	126
PID 1556 wrote to memory of 2712	1556	xhopeless.exe	128
PID 1556 wrote to memory of 1076	1556	xhopeless.exe	130
PID 1556 wrote to memory of 828	1556	xhopeless.exe	132
PID 1556 wrote to memory of 6072	1556	xhopeless.exe	134
PID 1556 wrote to memory of 1400	1556	xhopeless.exe	136
PID 1556 wrote to memory of 1332	1556	xhopeless.exe	138
PID 1556 wrote to memory of 3440	1556	xhopeless.exe	140
PID 1556 wrote to memory of 5368	1556	xhopeless.exe	142
PID 1556 wrote to memory of 4804	1556	xhopeless.exe	144
PID 1556 wrote to memory of 1624	1556	xhopeless.exe	146
PID 1556 wrote to memory of 1460	1556	xhopeless.exe	148
PID 1556 wrote to memory of 4344	1556	xhopeless.exe	150
PID 1556 wrote to memory of 1392	1556	xhopeless.exe	152
PID 1556 wrote to memory of 4460	1556	xhopeless.exe	154
PID 1556 wrote to memory of 1184	1556	xhopeless.exe	156
PID 1556 wrote to memory of 6108	1556	xhopeless.exe	158
PID 1556 wrote to memory of 4332	1556	xhopeless.exe	160
PID 1556 wrote to memory of 4092	1556	xhopeless.exe	162
PID 1556 wrote to memory of 2192	1556	xhopeless.exe	164
PID 1556 wrote to memory of 432	1556	xhopeless.exe	166
PID 1556 wrote to memory of 5928	1556	xhopeless.exe	168
PID 1556 wrote to memory of 4388	1556	xhopeless.exe	170
PID 1556 wrote to memory of 5388	1556	xhopeless.exe	172
PID 1556 wrote to memory of 5816	1556	xhopeless.exe	174
PID 1556 wrote to memory of 4540	1556	xhopeless.exe	176
PID 1556 wrote to memory of 4520	1556	xhopeless.exe	178
PID 1556 wrote to memory of 2440	1556	xhopeless.exe	180
PID 1556 wrote to memory of 1888	1556	xhopeless.exe	182
PID 1556 wrote to memory of 2460	1556	xhopeless.exe	184
PID 1556 wrote to memory of 5164	1556	xhopeless.exe	186
PID 1556 wrote to memory of 5480	1556	xhopeless.exe	188
PID 1556 wrote to memory of 5724	1556	xhopeless.exe	190
PID 1556 wrote to memory of 2720	1556	xhopeless.exe	192
PID 1556 wrote to memory of 1096	1556	xhopeless.exe	194
PID 1556 wrote to memory of 2072	1556	xhopeless.exe	196
PID 1556 wrote to memory of 4544	1556	xhopeless.exe	198
PID 1556 wrote to memory of 4456	1556	xhopeless.exe	200
PID 1556 wrote to memory of 6128	1556	xhopeless.exe	202
PID 1556 wrote to memory of 4960	1556	xhopeless.exe	204
PID 1556 wrote to memory of 5888	1556	xhopeless.exe	206
PID 1556 wrote to memory of 572	1556	xhopeless.exe	208
PID 1556 wrote to memory of 1660	1556	xhopeless.exe	210
PID 1556 wrote to memory of 940	1556	xhopeless.exe	212
PID 1556 wrote to memory of 4972	1556	xhopeless.exe	336
PID 1556 wrote to memory of 3408	1556	xhopeless.exe	216
PID 1556 wrote to memory of 5988	1556	xhopeless.exe	218

C:\Users\Admin\AppData\Local\Temp\xhopeless.exe
"C:\Users\Admin\AppData\Local\Temp\xhopeless.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Event Triggered Execution: Image File Execution Options Injection
- Looks for VMWare Tools registry key
- Windows security modification
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:4316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:5408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:1596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:3920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c A
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c H
  2⤵
  PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  PID:292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:2712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:6072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:1392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:2192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:2440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:5724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:2720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:2072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c p
  2⤵
  - Executes a command shell one-liner
  PID:4544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:5988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:5652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:5152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:2760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1084
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3192
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:6120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:1108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c i
  2⤵
  PID:3452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:4536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c n
  2⤵
  PID:5884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:4632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:52
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5676
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:2488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:4208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:5752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:4580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c c
  2⤵
  PID:1184
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:5772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:5192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:6112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:3716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:4776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:2684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:3968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:4580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5796
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:4284

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv D+hSPYZxYEGqMqvwhmvy6Q.0
1⤵
PID:6088

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv Vsuj52REyUuf5wLUTDzfNQ.0
1⤵
PID:5464

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:3616
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3232

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4972

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4484

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion