bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
Size 533KB
Sample260903-mftbkage97
SHA256 bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794
MD5 ceb48f9b81a741735347eb06aef1acbc
SHA1 865dfdd68dfae8486e97fdf4427046c2fab0f416
SHA512 a681c974904c33ac3294295708d1bb95b9d2d9ac59154ba48029832ad02ff0a005b8a0da36e3876c1c870e7aae7a35dd892852a0ffb144123f21204c6df923bc
SSDEEP 12288:ECJTjH4Kliom3pIil/IGEUaOS44nbxHBn3dc3ucOLDuV:JJTEKliom3pIil/IGEUaOgnbPNc3bOnm
TLSH
T162C48D8EB79907F8D177E074C66A8947F731780D0771AA9F03E146A61F236E09E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp = "0"	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1700	Helper.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	Helper.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5392	powershell.exe
1712	powershell.exe
2704	powershell.exe
952	powershell.exe
1416	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
9	icanhazip.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001b87f-12.dat	upx
behavioral2/memory/1700-13-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-78-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-85-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-92-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-104-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-115-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-126-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-137-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-148-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-167-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-178-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-188-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-199-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-209-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-220-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx
behavioral2/memory/1700-238-0x00007FF8106B0000-0x00007FF810725000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fuq0df0d.pmb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t21fofsp.tzj.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5f0xaqfe.sod.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3k2lxasb.xd0.ps1	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2684	powershell.exe
4208	powershell.exe
5092	powershell.exe
4324	powershell.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
1700	Helper.exe
5392	powershell.exe
5392	powershell.exe
1700	Helper.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
1416	powershell.exe
1416	powershell.exe
1700	Helper.exe
1700	Helper.exe
1416	powershell.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1712	powershell.exe
1712	powershell.exe
1712	powershell.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
1700	Helper.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
1700	Helper.exe
2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeIncreaseQuotaPrivilege	5392	powershell.exe
Token: SeSecurityPrivilege	5392	powershell.exe
Token: SeTakeOwnershipPrivilege	5392	powershell.exe
Token: SeLoadDriverPrivilege	5392	powershell.exe
Token: SeSystemProfilePrivilege	5392	powershell.exe
Token: SeSystemtimePrivilege	5392	powershell.exe
Token: SeProfSingleProcessPrivilege	5392	powershell.exe
Token: SeIncBasePriorityPrivilege	5392	powershell.exe
Token: SeCreatePagefilePrivilege	5392	powershell.exe
Token: SeBackupPrivilege	5392	powershell.exe
Token: SeRestorePrivilege	5392	powershell.exe
Token: SeShutdownPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeSystemEnvironmentPrivilege	5392	powershell.exe
Token: SeRemoteShutdownPrivilege	5392	powershell.exe
Token: SeUndockPrivilege	5392	powershell.exe
Token: SeManageVolumePrivilege	5392	powershell.exe
Token: 33	5392	powershell.exe
Token: 34	5392	powershell.exe
Token: 35	5392	powershell.exe
Token: 36	5392	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeIncreaseQuotaPrivilege	1416	powershell.exe
Token: SeSecurityPrivilege	1416	powershell.exe
Token: SeTakeOwnershipPrivilege	1416	powershell.exe
Token: SeLoadDriverPrivilege	1416	powershell.exe
Token: SeSystemProfilePrivilege	1416	powershell.exe
Token: SeSystemtimePrivilege	1416	powershell.exe
Token: SeProfSingleProcessPrivilege	1416	powershell.exe
Token: SeIncBasePriorityPrivilege	1416	powershell.exe
Token: SeCreatePagefilePrivilege	1416	powershell.exe
Token: SeBackupPrivilege	1416	powershell.exe
Token: SeRestorePrivilege	1416	powershell.exe
Token: SeShutdownPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeSystemEnvironmentPrivilege	1416	powershell.exe
Token: SeRemoteShutdownPrivilege	1416	powershell.exe
Token: SeUndockPrivilege	1416	powershell.exe
Token: SeManageVolumePrivilege	1416	powershell.exe
Token: 33	1416	powershell.exe
Token: 34	1416	powershell.exe
Token: 35	1416	powershell.exe
Token: 36	1416	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4208	powershell.exe
Token: SeIncreaseQuotaPrivilege	4208	powershell.exe
Token: SeSecurityPrivilege	4208	powershell.exe
Token: SeTakeOwnershipPrivilege	4208	powershell.exe
Token: SeLoadDriverPrivilege	4208	powershell.exe
Token: SeSystemtimePrivilege	4208	powershell.exe
Token: SeBackupPrivilege	4208	powershell.exe
Token: SeRestorePrivilege	4208	powershell.exe
Token: SeShutdownPrivilege	4208	powershell.exe
Token: SeSystemEnvironmentPrivilege	4208	powershell.exe
Token: SeUndockPrivilege	4208	powershell.exe
Token: SeManageVolumePrivilege	4208	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeIncreaseQuotaPrivilege	2704	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1700	2592	bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe	89
PID 1700 wrote to memory of 5392	1700	Helper.exe	91
PID 1700 wrote to memory of 2684	1700	Helper.exe	94
PID 1700 wrote to memory of 1416	1700	Helper.exe	96
PID 1700 wrote to memory of 1712	1700	Helper.exe	98
PID 1700 wrote to memory of 5092	1700	Helper.exe	102
PID 1700 wrote to memory of 4324	1700	Helper.exe	106
PID 1700 wrote to memory of 2704	1700	Helper.exe	113
PID 1700 wrote to memory of 952	1700	Helper.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
"C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\AgentModules\Helper.exe
  C:\Users\Admin\AppData\Local\Temp\AgentModules\Helper.exe -pipe \\.\pipe\SVP7_Agent_5697a69f01e1b402a40e24beac88cf8a_HostInfoDll -dll C:\Users\Admin\AppData\Local\Temp\AgentModules\HostInfoDll.dll -interval 15 -guard 1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $p='HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'; Get-Item -Path $p -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Property"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; try { Set-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $p='HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'; $ErrorActionPreference='Stop'; try { New-Item -Path $p -Force | Out-Null; New-ItemProperty -Path $p -Name 'C:\Users\Admin\AppData\Local\Temp' -Value 0 -PropertyType DWord -Force | Out-Null; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $p='HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'; Get-Item -Path $p -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Property"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $p='HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'; Get-Item -Path $p -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Property"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$p='HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths'; try { New-Item -Path $p -Force | Out-Null; New-ItemProperty -Path $p -Name 'C:\Users\Admin\AppData\Local\Temp' -Value 0 -PropertyType DWord -Force | Out-Null; exit 0 } finally { Unregister-ScheduledTask -TaskName 'StartOobeAppsScan_OobeAppReadyBackup' -Confirm:$false -ErrorAction SilentlyContinue }"
1⤵
- Windows security bypass
- Drops file in System32 directory
- Drops file in Windows directory
- Hide Artifacts: Ignore Process Interrupts
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
1⤵
PID:4728

C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
"C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe"
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe
"C:\Users\Admin\AppData\Local\Temp\bcec0dee5fd43ed238a5c3b781ad3bb3e2104b41904070e0823c9ddf79b08794.exe"
1⤵
PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...