80fe30a09706ee903fa6ffb1a696d7d5548b3d9d981964e4ec58b29e0ca18327

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CloudflareVerify.exe
Size 1.7MB
Sample260907-al25fadh65
SHA256 80fe30a09706ee903fa6ffb1a696d7d5548b3d9d981964e4ec58b29e0ca18327
MD5 fe85e7fbf16842c5221cc1f6748e105d
SHA1 8f3f4ad974fa80b3c5dfca878358c74fdcd414f8
SHA512 be1e35f9feaad575d792dd656aa1d29907df5c88cbded3f41bb115f700b043fb39c4095da0eafc6f554121b97e6127ad1b7adea421410a01c9458ab85c2cbc7d
SSDEEP 24576:7msshSxhx2ny1HbKXSmQBJlxTzjjOZH/xN98GrMnMR:7ms1nx6wKXSpBFTTOZfxT8Gwn
TLSH
T184854A03E7B580A8CCDAC1F8837A9733EA75BC8A4534766B17D04A21EE6DB509B1DF05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4428	powershell.exe
3848	powershell.exe
4316	powershell.exe
228	powershell.exe
1740	powershell.exe
4528	powershell.exe
3820	powershell.exe
388	powershell.exe

Creates a file in the Startup directory 1 TTPs 16 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk	systemservice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk	systemservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk	CloudflareVerify.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk	CloudflareVerify.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk	systemservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	systemservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	CloudflareVerify.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk	CloudflareVerify.exe

Executes dropped EXE 3 IoCs

pid	Process
3008	systemservice.exe
3708	systemservice.exe
3468	systemservice.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	CloudflareVerify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	CloudflareVerify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	CloudflareVerify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	systemservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	systemservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\SystemService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemService\\systemservice.exe"	systemservice.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1184	cmd.exe
3920	cmd.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe
4260	cmd.exe
4732	cmd.exe
1128	cmd.exe
2820	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2820	cmd.exe
3868	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3868	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5064	schtasks.exe
4584	schtasks.exe
4168	schtasks.exe
4012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4528	powershell.exe
4528	powershell.exe
3820	powershell.exe
3820	powershell.exe
388	powershell.exe
388	powershell.exe
4428	powershell.exe
4428	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1184	4300	CloudflareVerify.exe	92
PID 1184 wrote to memory of 764	1184	cmd.exe	94
PID 4300 wrote to memory of 4732	4300	CloudflareVerify.exe	96
PID 4732 wrote to memory of 4012	4732	cmd.exe	98
PID 4300 wrote to memory of 1128	4300	CloudflareVerify.exe	99
PID 1128 wrote to memory of 5064	1128	cmd.exe	102
PID 4300 wrote to memory of 3700	4300	CloudflareVerify.exe	103
PID 4300 wrote to memory of 4528	4300	CloudflareVerify.exe	105
PID 4300 wrote to memory of 3196	4300	CloudflareVerify.exe	108
PID 4300 wrote to memory of 3820	4300	CloudflareVerify.exe	111
PID 4300 wrote to memory of 1736	4300	CloudflareVerify.exe	113
PID 4300 wrote to memory of 388	4300	CloudflareVerify.exe	115
PID 4300 wrote to memory of 3848	4300	CloudflareVerify.exe	117
PID 4300 wrote to memory of 4428	4300	CloudflareVerify.exe	119
PID 4300 wrote to memory of 2820	4300	CloudflareVerify.exe	121
PID 4300 wrote to memory of 3468	4300	CloudflareVerify.exe	122
PID 2820 wrote to memory of 3868	2820	cmd.exe	124
PID 3468 wrote to memory of 3920	3468	systemservice.exe	136
PID 3920 wrote to memory of 1736	3920	cmd.exe	138
PID 3468 wrote to memory of 2100	3468	systemservice.exe	139
PID 2100 wrote to memory of 4584	2100	cmd.exe	141
PID 3468 wrote to memory of 4260	3468	systemservice.exe	142
PID 4260 wrote to memory of 4168	4260	cmd.exe	144
PID 3468 wrote to memory of 5024	3468	systemservice.exe	145
PID 3468 wrote to memory of 3848	3468	systemservice.exe	147
PID 3468 wrote to memory of 4428	3468	systemservice.exe	149
PID 3468 wrote to memory of 4316	3468	systemservice.exe	151
PID 3468 wrote to memory of 4616	3468	systemservice.exe	153
PID 3468 wrote to memory of 228	3468	systemservice.exe	155
PID 3468 wrote to memory of 1216	3468	systemservice.exe	157
PID 3468 wrote to memory of 1740	3468	systemservice.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CloudflareVerify.exe
"C:\Users\Admin\AppData\Local\Temp\CloudflareVerify.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"SystemService\" /f 2>nul"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"SystemService\" /f
    3⤵
    PID:764
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /create /tn \"SystemService\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc onlogon /f 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemService\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4012
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /create /tn \"SystemService_Repeat\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc minute /mo 30 /f 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemService_Repeat\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc minute /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\system32\cscript.exe
  "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
  2⤵
  PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\system32\cscript.exe
  "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
  2⤵
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\cscript.exe
  "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
  2⤵
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:388
- C:\Windows\system32\cscript.exe
  "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
  2⤵
  PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\system32\cmd.exe
  "cmd" /C "ping 127.0.0.1 -n 3 > nul & del /F /Q \"C:\Users\Admin\AppData\Local\Temp\CloudflareVerify.exe\" 2>nul"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3868
- C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe
  "C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\cmd.exe
    "cmd" /C "schtasks /delete /tn \"SystemService\" /f 2>nul"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn \"SystemService\" /f
      4⤵
      PID:1736
- - C:\Windows\system32\cmd.exe
    "cmd" /C "schtasks /create /tn \"SystemService\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc onlogon /f 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"SystemService\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4584
- - C:\Windows\system32\cmd.exe
    "cmd" /C "schtasks /create /tn \"SystemService_Repeat\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc minute /mo 30 /f 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"SystemService_Repeat\" /tr \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\" /sc minute /mo 30 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- - C:\Windows\system32\cscript.exe
    "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
    3⤵
    PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\system32\cscript.exe
    "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
    3⤵
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCore.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\system32\cscript.exe
    "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
    3⤵
    PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateService.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\system32\cscript.exe
    "cscript" //nologo //E:vbscript -e "Set WshShell = CreateObject(\"WScript.Shell\"):Set Shortcut = WshShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk\"):Shortcut.TargetPath = \"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe\":Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Roaming\SystemService\":Shortcut.WindowStyle = 7:Shortcut.Save"
    3⤵
    PID:1216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -WindowStyle Hidden -Command "$s=New-Object -COM WScript.Shell;$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemService.lnk');$l.TargetPath='C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Roaming\SystemService';$l.WindowStyle=7;$l.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1740

C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe
C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe
"C:\Users\Admin\AppData\Roaming\SystemService\systemservice.exe"
1⤵
- Executes dropped EXE
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...