1fd70c0f44f9bc9a1428f815c2ebc8bb3c7b438e1f6d41ee18a02b967c0b9a00

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	svchost.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	svchost.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	svchost.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	svchost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3968	bcdedit.exe
1112	bcdedit.exe
4880	bcdedit.exe
5764	bcdedit.exe
6072	bcdedit.exe
5484	bcdedit.exe
2516	bcdedit.exe
4588	bcdedit.exe
460	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5984	powershell.exe
1568	powershell.exe
5264	powershell.exe
5724	powershell.exe
1116	powershell.exe
3160	powershell.exe
5524	powershell.exe
3040	powershell.exe
4988	powershell.exe
1960	powershell.exe
2076	powershell.exe
2072	powershell.exe
5348	powershell.exe
4036	powershell.exe
5436	powershell.exe
1424	powershell.exe
5676	powershell.exe
408	powershell.exe
4272	powershell.exe
5056	powershell.exe
4604	powershell.exe
5060	powershell.exe
5352	powershell.exe
5764	powershell.exe
4984	powershell.exe
5756	powershell.exe
5716	powershell.exe
1764	powershell.exe
3732	powershell.exe
4876	powershell.exe
4056	powershell.exe
5800	powershell.exe
6092	powershell.exe
1424	powershell.exe
1604	powershell.exe
2964	powershell.exe
4952	powershell.exe
5936	powershell.exe
3496	powershell.exe
2336	powershell.exe
216	powershell.exe
5304	powershell.exe
5820	powershell.exe
6052	powershell.exe
1144	powershell.exe
5140	powershell.exe
4244	powershell.exe
3432	powershell.exe
2660	powershell.exe
3896	powershell.exe
5424	powershell.exe
5884	powershell.exe
1708	powershell.exe
4624	powershell.exe
2284	powershell.exe
5240	powershell.exe
5124	powershell.exe
1752	powershell.exe
4048	powershell.exe
460	powershell.exe
5408	powershell.exe
4756	powershell.exe
5992	powershell.exe
4808	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	svchost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	svchost.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	svchost.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4640	SecurityHealthService.exe
4820	SecurityHealthService.exe
5316	SecurityHealthService.exe
5536	SecurityHealthService.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
5316	SecurityHealthService.exe
5316	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	discord.com
42	discord.com
43	discord.com
59	discord.com
60	discord.com
62	discord.com
63	discord.com
32	discord.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Discovers running processes 1 TTPs 26 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4696	tasklist.exe
220	tasklist.exe
568	tasklist.exe
1596	tasklist.exe
2772	tasklist.exe
5616	tasklist.exe
3896	tasklist.exe
2512	tasklist.exe
6036	tasklist.exe
3964	tasklist.exe
5728	tasklist.exe
1960	tasklist.exe
5264	tasklist.exe
5872	tasklist.exe
1104	tasklist.exe
5576	tasklist.exe
2748	tasklist.exe
208	tasklist.exe
5680	tasklist.exe
2772	tasklist.exe
2096	tasklist.exe
4452	tasklist.exe
6064	tasklist.exe
5544	tasklist.exe
388	tasklist.exe
5572	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4364	svchost.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	svchost.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3688	cmd.exe
1628	cmd.exe
2964	cmd.exe
6040	cmd.exe
2388	cmd.exe
1672	cmd.exe
5052	cmd.exe
6060	cmd.exe
4508	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3924	schtasks.exe
2020	schtasks.exe
6000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4364	svchost.exe
4244	powershell.exe
4244	powershell.exe
408	powershell.exe
408	powershell.exe
4056	powershell.exe
4056	powershell.exe
4604	powershell.exe
4604	powershell.exe
1568	powershell.exe
1568	powershell.exe
2284	powershell.exe
2284	powershell.exe
2076	powershell.exe
2076	powershell.exe
3496	powershell.exe
3496	powershell.exe
2072	powershell.exe
2072	powershell.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
5316	SecurityHealthService.exe
5316	SecurityHealthService.exe
5536	SecurityHealthService.exe
5536	SecurityHealthService.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
5464	powershell.exe
5464	powershell.exe
5464	powershell.exe
5316	SecurityHealthService.exe
5316	SecurityHealthService.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5408	powershell.exe
5408	powershell.exe
5348	powershell.exe
5348	powershell.exe
5408	powershell.exe
5348	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
5716	powershell.exe
5716	powershell.exe
5716	powershell.exe
5536	SecurityHealthService.exe
5536	SecurityHealthService.exe
5240	powershell.exe
5240	powershell.exe
5240	powershell.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe
5904	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	svchost.exe
Token: SeDebugPrivilege	4452	tasklist.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeIncreaseQuotaPrivilege	408	powershell.exe
Token: SeSecurityPrivilege	408	powershell.exe
Token: SeTakeOwnershipPrivilege	408	powershell.exe
Token: SeLoadDriverPrivilege	408	powershell.exe
Token: SeSystemProfilePrivilege	408	powershell.exe
Token: SeSystemtimePrivilege	408	powershell.exe
Token: SeProfSingleProcessPrivilege	408	powershell.exe
Token: SeIncBasePriorityPrivilege	408	powershell.exe
Token: SeCreatePagefilePrivilege	408	powershell.exe
Token: SeBackupPrivilege	408	powershell.exe
Token: SeRestorePrivilege	408	powershell.exe
Token: SeShutdownPrivilege	408	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeSystemEnvironmentPrivilege	408	powershell.exe
Token: SeRemoteShutdownPrivilege	408	powershell.exe
Token: SeUndockPrivilege	408	powershell.exe
Token: SeManageVolumePrivilege	408	powershell.exe
Token: 33	408	powershell.exe
Token: 34	408	powershell.exe
Token: 35	408	powershell.exe
Token: 36	408	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4364	64	svchost.exe	88
PID 4364 wrote to memory of 2388	4364	svchost.exe	90
PID 4364 wrote to memory of 4452	4364	svchost.exe	93
PID 4364 wrote to memory of 4244	4364	svchost.exe	95
PID 4364 wrote to memory of 408	4364	svchost.exe	97
PID 4364 wrote to memory of 4056	4364	svchost.exe	99
PID 4364 wrote to memory of 1556	4364	svchost.exe	101
PID 4364 wrote to memory of 4604	4364	svchost.exe	103
PID 4364 wrote to memory of 4696	4364	svchost.exe	106
PID 4364 wrote to memory of 1568	4364	svchost.exe	108
PID 4364 wrote to memory of 2284	4364	svchost.exe	110
PID 4364 wrote to memory of 2076	4364	svchost.exe	112
PID 4364 wrote to memory of 3496	4364	svchost.exe	114
PID 4364 wrote to memory of 216	4364	svchost.exe	123
PID 4364 wrote to memory of 220	4364	svchost.exe	125
PID 4364 wrote to memory of 2072	4364	svchost.exe	127
PID 4364 wrote to memory of 1672	4364	svchost.exe	129
PID 1672 wrote to memory of 568	1672	cmd.exe	131
PID 4364 wrote to memory of 3924	4364	svchost.exe	133
PID 4364 wrote to memory of 5052	4364	svchost.exe	135
PID 5052 wrote to memory of 1596	5052	cmd.exe	137
PID 4364 wrote to memory of 3968	4364	svchost.exe	138
PID 4364 wrote to memory of 1112	4364	svchost.exe	140
PID 4364 wrote to memory of 4880	4364	svchost.exe	142
PID 4364 wrote to memory of 3792	4364	svchost.exe	148
PID 4364 wrote to memory of 1932	4364	svchost.exe	151
PID 4364 wrote to memory of 3860	4364	svchost.exe	153
PID 4364 wrote to memory of 1604	4364	svchost.exe	155
PID 4640 wrote to memory of 5316	4640	SecurityHealthService.exe	157
PID 4820 wrote to memory of 5536	4820	SecurityHealthService.exe	158
PID 5536 wrote to memory of 6060	5536	SecurityHealthService.exe	194
PID 5316 wrote to memory of 6040	5316	SecurityHealthService.exe	161
PID 4364 wrote to memory of 5656	4364	svchost.exe	163
PID 4364 wrote to memory of 5732	4364	svchost.exe	198
PID 4364 wrote to memory of 4272	4364	svchost.exe	167
PID 5536 wrote to memory of 1104	5536	SecurityHealthService.exe	218
PID 5316 wrote to memory of 6064	5316	SecurityHealthService.exe	171
PID 4364 wrote to memory of 6036	4364	svchost.exe	173
PID 4364 wrote to memory of 6004	4364	svchost.exe	175
PID 4364 wrote to memory of 2336	4364	svchost.exe	177
PID 4364 wrote to memory of 4852	4364	svchost.exe	179
PID 4364 wrote to memory of 5464	4364	svchost.exe	181
PID 5316 wrote to memory of 5060	5316	SecurityHealthService.exe	183
PID 4364 wrote to memory of 5484	4364	svchost.exe	185
PID 5316 wrote to memory of 5408	5316	SecurityHealthService.exe	187
PID 5536 wrote to memory of 5348	5536	SecurityHealthService.exe	189
PID 5316 wrote to memory of 4756	5316	SecurityHealthService.exe	191
PID 5536 wrote to memory of 5576	5536	SecurityHealthService.exe	193
PID 5316 wrote to memory of 3792	5316	SecurityHealthService.exe	195
PID 5316 wrote to memory of 5716	5316	SecurityHealthService.exe	292
PID 5316 wrote to memory of 2748	5316	SecurityHealthService.exe	199
PID 5536 wrote to memory of 5240	5536	SecurityHealthService.exe	201
PID 4364 wrote to memory of 5984	4364	svchost.exe	203
PID 5536 wrote to memory of 2516	5536	SecurityHealthService.exe	205
PID 4364 wrote to memory of 4888	4364	svchost.exe	207
PID 4364 wrote to memory of 3968	4364	svchost.exe	298
PID 4364 wrote to memory of 5904	4364	svchost.exe	211
PID 5536 wrote to memory of 404	5536	SecurityHealthService.exe	213

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Creates a file in the Startup directory
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2388
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4604
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3496
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:216
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:568
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1596
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3968
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1112
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4880
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3792
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1932
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5656
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4272
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5464
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5484
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5984
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4888
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5904
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3432
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5800
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5728
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5264
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3896
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5256
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6092
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:1424
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5436
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5820
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5160
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1840
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6120
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5764
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:3968
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5524
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1576
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:3040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:5788
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5796
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5828
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1764
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5680
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5140
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1960
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5544
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:5448
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6076
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:4360
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4984
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3732
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2616
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1144
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3496
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1116
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5032
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:2336
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1664
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4808
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5444
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5936

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:6040
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:6064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:3792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5732
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5424
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:2896
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2964
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5264
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2516
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4588
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:460
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1448
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5056
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5984
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5784
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5872
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:460
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1848
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5428

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:6060
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5348
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    PID:404
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5352
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:388
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5764
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6072
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5484
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5260
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5992
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4876
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1424
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4952
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5980
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4876
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5884
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5304
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3160
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4020
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2512
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4988
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:4368
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion