8fb39c3d9381165fc41645e46c4fc1c2417ba9d9593f0973f39bc49082d2fe43

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
4984	powershell.exe
1364	powershell.exe
3416	powershell.exe
2880	powershell.exe
4824	powershell.exe
3476	powershell.exe
1880	powershell.exe
4896	powershell.exe
4800	powershell.exe
5044	powershell.exe
1668	powershell.exe
2588	powershell.exe
5928	powershell.exe
5596	powershell.exe
1936	powershell.exe
2008	powershell.exe
5832	powershell.exe
4428	powershell.exe
3540	powershell.exe
2340	powershell.exe
5032	powershell.exe
4240	powershell.exe
1512	powershell.exe
4584	powershell.exe
2820	powershell.exe
5312	powershell.exe
3476	powershell.exe
4972	powershell.exe
2420	powershell.exe
4564	powershell.exe
2028	powershell.exe
5436	powershell.exe
2524	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes dropped EXE 4 IoCs

pid	Process
3936	SecurityHealthService.exe
5416	SecurityHealthService.exe
2760	SecurityHealthService.exe
3880	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2760	SecurityHealthService.exe
3880	SecurityHealthService.exe
2760	SecurityHealthService.exe
2760	SecurityHealthService.exe
3880	SecurityHealthService.exe
2760	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
14	discord.com
1	discord.com
7	discord.com
8	discord.com
10	discord.com
11	discord.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Discovers running processes 1 TTPs 22 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2028	tasklist.exe
2548	tasklist.exe
2008	tasklist.exe
5788	tasklist.exe
4844	tasklist.exe
2340	tasklist.exe
4668	tasklist.exe
4896	tasklist.exe
4904	tasklist.exe
5424	tasklist.exe
1924	tasklist.exe
1740	tasklist.exe
1648	tasklist.exe
3728	tasklist.exe
4684	tasklist.exe
4156	tasklist.exe
476	tasklist.exe
4428	tasklist.exe
5060	tasklist.exe
3848	tasklist.exe
3084	tasklist.exe
5544	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3880	SecurityHealthService.exe
2760	SecurityHealthService.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe
6112	cmd.exe
4536	cmd.exe
3240	cmd.exe
5864	cmd.exe
2820	cmd.exe
1136	cmd.exe
2768	cmd.exe
1188	cmd.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	powershell.exe
5312	powershell.exe
2420	powershell.exe
2420	powershell.exe
5044	powershell.exe
5044	powershell.exe
5572	wmic.exe
5572	wmic.exe
5572	wmic.exe
5572	wmic.exe
3476	powershell.exe
3476	powershell.exe
1936	powershell.exe
1936	powershell.exe
1668	powershell.exe
1668	powershell.exe
2588	powershell.exe
2588	powershell.exe
1512	powershell.exe
1512	powershell.exe
4824	powershell.exe
4824	powershell.exe
2760	SecurityHealthService.exe
2760	SecurityHealthService.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
3880	SecurityHealthService.exe
3880	SecurityHealthService.exe
5928	powershell.exe
5928	powershell.exe
5928	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
5596	powershell.exe
5596	powershell.exe
5596	powershell.exe
4772	wmic.exe
4772	wmic.exe
4772	wmic.exe
4772	wmic.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
5328	wmic.exe
5328	wmic.exe
5328	wmic.exe
5328	wmic.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
4584	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	2028	tasklist.exe
Token: SeDebugPrivilege	5312	powershell.exe
Token: SeIncreaseQuotaPrivilege	5312	powershell.exe
Token: SeSecurityPrivilege	5312	powershell.exe
Token: SeTakeOwnershipPrivilege	5312	powershell.exe
Token: SeLoadDriverPrivilege	5312	powershell.exe
Token: SeSystemProfilePrivilege	5312	powershell.exe
Token: SeSystemtimePrivilege	5312	powershell.exe
Token: SeProfSingleProcessPrivilege	5312	powershell.exe
Token: SeIncBasePriorityPrivilege	5312	powershell.exe
Token: SeCreatePagefilePrivilege	5312	powershell.exe
Token: SeBackupPrivilege	5312	powershell.exe
Token: SeRestorePrivilege	5312	powershell.exe
Token: SeShutdownPrivilege	5312	powershell.exe
Token: SeDebugPrivilege	5312	powershell.exe
Token: SeSystemEnvironmentPrivilege	5312	powershell.exe
Token: SeRemoteShutdownPrivilege	5312	powershell.exe
Token: SeUndockPrivilege	5312	powershell.exe
Token: SeManageVolumePrivilege	5312	powershell.exe
Token: 33	5312	powershell.exe
Token: 34	5312	powershell.exe
Token: 35	5312	powershell.exe
Token: 36	5312	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	2420	powershell.exe
Token: SeSecurityPrivilege	2420	powershell.exe
Token: SeTakeOwnershipPrivilege	2420	powershell.exe
Token: SeLoadDriverPrivilege	2420	powershell.exe
Token: SeSystemProfilePrivilege	2420	powershell.exe
Token: SeSystemtimePrivilege	2420	powershell.exe
Token: SeProfSingleProcessPrivilege	2420	powershell.exe
Token: SeIncBasePriorityPrivilege	2420	powershell.exe
Token: SeCreatePagefilePrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2420	powershell.exe
Token: SeRestorePrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeSystemEnvironmentPrivilege	2420	powershell.exe
Token: SeRemoteShutdownPrivilege	2420	powershell.exe
Token: SeUndockPrivilege	2420	powershell.exe
Token: SeManageVolumePrivilege	2420	powershell.exe
Token: 33	2420	powershell.exe
Token: 34	2420	powershell.exe
Token: 35	2420	powershell.exe
Token: 36	2420	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeIncreaseQuotaPrivilege	5044	powershell.exe
Token: SeSecurityPrivilege	5044	powershell.exe
Token: SeTakeOwnershipPrivilege	5044	powershell.exe
Token: SeLoadDriverPrivilege	5044	powershell.exe
Token: SeSystemProfilePrivilege	5044	powershell.exe
Token: SeSystemtimePrivilege	5044	powershell.exe
Token: SeProfSingleProcessPrivilege	5044	powershell.exe
Token: SeIncBasePriorityPrivilege	5044	powershell.exe
Token: SeCreatePagefilePrivilege	5044	powershell.exe
Token: SeBackupPrivilege	5044	powershell.exe
Token: SeRestorePrivilege	5044	powershell.exe
Token: SeShutdownPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeSystemEnvironmentPrivilege	5044	powershell.exe
Token: SeRemoteShutdownPrivilege	5044	powershell.exe
Token: SeUndockPrivilege	5044	powershell.exe
Token: SeManageVolumePrivilege	5044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 4948	5952	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4948 wrote to memory of 1188	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4948 wrote to memory of 2028	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4948 wrote to memory of 5312	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 4948 wrote to memory of 2420	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 4948 wrote to memory of 5044	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 4948 wrote to memory of 5572	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 4948 wrote to memory of 3476	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4948 wrote to memory of 2548	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 4948 wrote to memory of 1936	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 4948 wrote to memory of 1668	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 4948 wrote to memory of 2588	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 4948 wrote to memory of 1512	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 4948 wrote to memory of 2008	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	162
PID 4948 wrote to memory of 4824	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 4948 wrote to memory of 4176	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 4176 wrote to memory of 3848	4176	cmd.exe	122
PID 4948 wrote to memory of 3240	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 3240 wrote to memory of 4684	3240	cmd.exe	219
PID 4948 wrote to memory of 2788	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 4948 wrote to memory of 2480	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4948 wrote to memory of 4628	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	198
PID 4948 wrote to memory of 3272	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 4948 wrote to memory of 4800	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 3936 wrote to memory of 2760	3936	SecurityHealthService.exe	140
PID 5416 wrote to memory of 3880	5416	SecurityHealthService.exe	141
PID 2760 wrote to memory of 6112	2760	SecurityHealthService.exe	142
PID 3880 wrote to memory of 5864	3880	SecurityHealthService.exe	144
PID 4948 wrote to memory of 1144	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 4948 wrote to memory of 5348	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	148
PID 2760 wrote to memory of 4156	2760	SecurityHealthService.exe	150
PID 3880 wrote to memory of 476	3880	SecurityHealthService.exe	152
PID 2760 wrote to memory of 2340	2760	SecurityHealthService.exe	154
PID 3880 wrote to memory of 5928	3880	SecurityHealthService.exe	269
PID 4948 wrote to memory of 3132	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	259
PID 2760 wrote to memory of 4972	2760	SecurityHealthService.exe	190
PID 3880 wrote to memory of 2008	3880	SecurityHealthService.exe	162
PID 2760 wrote to memory of 5832	2760	SecurityHealthService.exe	164
PID 3880 wrote to memory of 5596	3880	SecurityHealthService.exe	166
PID 2760 wrote to memory of 4772	2760	SecurityHealthService.exe	168
PID 2760 wrote to memory of 3476	2760	SecurityHealthService.exe	170
PID 4948 wrote to memory of 1752	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	172
PID 3880 wrote to memory of 5328	3880	SecurityHealthService.exe	174
PID 3880 wrote to memory of 4984	3880	SecurityHealthService.exe	176
PID 2760 wrote to memory of 3084	2760	SecurityHealthService.exe	178
PID 3880 wrote to memory of 4896	3880	SecurityHealthService.exe	212
PID 2760 wrote to memory of 4428	2760	SecurityHealthService.exe	214
PID 4948 wrote to memory of 1480	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	184
PID 3880 wrote to memory of 4584	3880	SecurityHealthService.exe	186
PID 2760 wrote to memory of 2820	2760	SecurityHealthService.exe	220
PID 3880 wrote to memory of 4972	3880	SecurityHealthService.exe	336
PID 2760 wrote to memory of 5032	2760	SecurityHealthService.exe	192
PID 4948 wrote to memory of 1936	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	224
PID 2760 wrote to memory of 1364	2760	SecurityHealthService.exe	196
PID 3880 wrote to memory of 1880	3880	SecurityHealthService.exe	299
PID 3880 wrote to memory of 4564	3880	SecurityHealthService.exe	243
PID 4948 wrote to memory of 2304	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	202
PID 4948 wrote to memory of 3428	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	302
PID 4948 wrote to memory of 5544	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	431
PID 3880 wrote to memory of 4904	3880	SecurityHealthService.exe	441
PID 4948 wrote to memory of 3920	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	210
PID 4948 wrote to memory of 4896	4948	2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	212
PID 2760 wrote to memory of 4428	2760	SecurityHealthService.exe	214
PID 3880 wrote to memory of 2028	3880	SecurityHealthService.exe	216

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_100cce8af5192aeb31462156637a78c9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1188
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4684
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3272
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1144
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5348
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1752
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1480
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1936
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2304
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5544
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4896
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1128
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4684
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:828
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3232
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5896
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5572
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3132
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4824
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1876
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2548
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6056
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1676
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:936
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1348
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4800
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4972
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1148
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3680
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5400
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3948
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5448
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1808
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5200
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2008
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4240
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3152
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1696
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:800
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1484
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5404
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3312
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1504

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5864
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5596
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4984
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4564
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5060
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2816
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5544
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3192
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2036
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3244
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1920
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3312
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3404
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3136
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6064
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1740
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3416
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5788
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1556
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1504
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2380
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5572
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3800
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3168
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2728
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3184
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5060
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:864
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5612
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4604
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5436
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2668
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3724
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1952
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2548
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3256
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1216

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:6112
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1364
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4628
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5424
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3028
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1924
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2644
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5928
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5376
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2348
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3184
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2156
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1880
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5836
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3056
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1760
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2880
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2900
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5528
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3000
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3384
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4824
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4352
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3424
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5032
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2588
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:968
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2168
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1476
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3728
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5544
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2524
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6032
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4344
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3324
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6112
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1044
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3588
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion