Analysis
- user interaction
yes - max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/09/2026, 15:31
General
- Target NewLauncher-2.0.9-windows-x64.exe
- Size 101.4MB
- Sample260913-sx3jfshp21
- SHA256 70152cde646c9ebe24e7015ca1f7f0b0c57822186bc0c77025d40d064cfd80ce
Score
10/10
Malware Config
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 2 IoCs
- UAC bypass 3 TTPs 51 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 54 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 54 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 53 IoCs
- Looks up external IP address via web service 1 TTPs 46 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 51 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"19⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"20⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"22⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"55⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"55⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'54⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"54⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"53⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'52⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"52⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'51⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"51⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'50⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"50⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'49⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"49⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'48⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"48⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'47⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"47⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'46⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"46⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'45⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"45⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'44⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"44⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'43⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"43⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'42⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"42⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"41⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"40⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"39⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'38⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"38⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"37⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'36⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"36⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"35⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'34⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"34⤵
- UAC bypass
- Executes dropped EXE
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'33⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"33⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'32⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"32⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'31⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"31⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'30⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"30⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'29⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"29⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'28⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"28⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'27⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"27⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'26⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"26⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'25⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"25⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'24⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"24⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"23⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"22⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'21⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"21⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'20⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"20⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'19⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"19⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'18⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"18⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'17⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"17⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'16⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"16⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"15⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"14⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"13⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"12⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"11⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"10⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"9⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"8⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"7⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"6⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"5⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
MsMpEng.exe.log
NewLauncher-2.0.9-windows-x64.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MsMpEng.exe
__PSScriptPolicyTest_tliimf3q.5fi.ps1
memory/3280-3-0x000002A0E8E20000-0x000002A0E8E30000-memory.dmp
memory/3280-2-0x000002A0E8E20000-0x000002A0E8E30000-memory.dmp
memory/3280-4-0x000002A0EB590000-0x000002A0EB5B2000-memory.dmp
memory/3488-0-0x0000000000240000-0x0000000001240000-memory.dmp
memory/3488-1-0x0000000021480000-0x0000000021490000-memory.dmp
memory/3708-26-0x00000000005C0000-0x00000000005D8000-memory.dmp
memory/4024-48-0x00000223FF320000-0x00000223FF53C000-memory.dmp