c7c3358383411e098dc43d45d149e38b14f11db7a2d677a156e1b977704d67d9

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	fortnitetweaks.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	fortnitetweaks.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1176	powershell.exe
2444	powershell.exe
3692	powershell.exe
2960	powershell.exe
4332	powershell.exe
3384	powershell.exe
2120	powershell.exe
5032	powershell.exe
3400	powershell.exe
4936	powershell.exe
4884	powershell.exe
5056	powershell.exe
3664	powershell.exe
436	powershell.exe
5080	powershell.exe
4748	powershell.exe
4436	powershell.exe
2464	powershell.exe
1892	powershell.exe
1408	powershell.exe
2720	powershell.exe
3872	powershell.exe
2940	powershell.exe
1572	powershell.exe
2144	powershell.exe
832	powershell.exe
2316	powershell.exe
4984	powershell.exe
2164	powershell.exe
1688	powershell.exe
4468	powershell.exe
4332	powershell.exe
3632	powershell.exe
1764	powershell.exe
1312	powershell.exe
3028	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	fortnitetweaks.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	teckzyy tweaks (4).exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	fortnitetweaks.exe

Executes dropped EXE 6 IoCs

pid	Process
3380	fortnitetweaks.exe
4312	fortnitetweaks.exe
4824	SecurityHealthService.exe
1876	SecurityHealthService.exe
3864	SecurityHealthService.exe
1944	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
1944	SecurityHealthService.exe
1944	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	fortnitetweaks.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	fortnitetweaks.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	discord.com
39	discord.com
63	discord.com
64	discord.com
65	discord.com
37	discord.com
40	discord.com
62	discord.com
66	discord.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
45	api.ipify.org
69	api.ipify.org
70	api.ipify.org
44	api.ipify.org

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1016	tasklist.exe
3364	tasklist.exe
2004	tasklist.exe
2644	tasklist.exe
4848	tasklist.exe
3944	tasklist.exe
1044	tasklist.exe
3956	tasklist.exe
5088	tasklist.exe
4240	tasklist.exe
4568	tasklist.exe
4884	tasklist.exe
2168	tasklist.exe
1952	tasklist.exe
2216	tasklist.exe
4644	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3104	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

Debugger Evasion

T1622

pid	Process
4312	fortnitetweaks.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	fortnitetweaks.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2668	cmd.exe
1268	cmd.exe
3620	cmd.exe
3384	cmd.exe
4336	cmd.exe
2236	cmd.exe
1496	cmd.exe
2904	cmd.exe
876	cmd.exe
1368	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fortnitetweaks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fortnitetweaks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fortnitetweaks.exe

Kills process with taskkill 1 IoCs

pid	Process
4636	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
1764	powershell.exe
1764	powershell.exe
1892	powershell.exe
1892	powershell.exe
436	powershell.exe
436	powershell.exe
1408	powershell.exe
1408	powershell.exe
2940	powershell.exe
2940	powershell.exe
3400	powershell.exe
3400	powershell.exe
3692	powershell.exe
3692	powershell.exe
4748	powershell.exe
4748	powershell.exe
4312	fortnitetweaks.exe
4312	fortnitetweaks.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
3864	SecurityHealthService.exe
3864	SecurityHealthService.exe
1572	powershell.exe
1572	powershell.exe
1572	powershell.exe
2720	powershell.exe
2720	powershell.exe
2720	powershell.exe
2164	powershell.exe
2164	powershell.exe
2164	powershell.exe
2144	powershell.exe
2144	powershell.exe
2144	powershell.exe
4936	powershell.exe
4936	powershell.exe
4936	powershell.exe
1944	SecurityHealthService.exe
1944	SecurityHealthService.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
2960	powershell.exe
2960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	fortnitetweaks.exe
Token: SeDebugPrivilege	4884	tasklist.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	3664	powershell.exe
Token: SeSecurityPrivilege	3664	powershell.exe
Token: SeTakeOwnershipPrivilege	3664	powershell.exe
Token: SeLoadDriverPrivilege	3664	powershell.exe
Token: SeSystemProfilePrivilege	3664	powershell.exe
Token: SeSystemtimePrivilege	3664	powershell.exe
Token: SeProfSingleProcessPrivilege	3664	powershell.exe
Token: SeIncBasePriorityPrivilege	3664	powershell.exe
Token: SeCreatePagefilePrivilege	3664	powershell.exe
Token: SeBackupPrivilege	3664	powershell.exe
Token: SeRestorePrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3664	powershell.exe
Token: SeRemoteShutdownPrivilege	3664	powershell.exe
Token: SeUndockPrivilege	3664	powershell.exe
Token: SeManageVolumePrivilege	3664	powershell.exe
Token: 33	3664	powershell.exe
Token: 34	3664	powershell.exe
Token: 35	3664	powershell.exe
Token: 36	3664	powershell.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeIncreaseQuotaPrivilege	1764	powershell.exe
Token: SeSecurityPrivilege	1764	powershell.exe
Token: SeTakeOwnershipPrivilege	1764	powershell.exe
Token: SeLoadDriverPrivilege	1764	powershell.exe
Token: SeSystemProfilePrivilege	1764	powershell.exe
Token: SeSystemtimePrivilege	1764	powershell.exe
Token: SeProfSingleProcessPrivilege	1764	powershell.exe
Token: SeIncBasePriorityPrivilege	1764	powershell.exe
Token: SeCreatePagefilePrivilege	1764	powershell.exe
Token: SeBackupPrivilege	1764	powershell.exe
Token: SeRestorePrivilege	1764	powershell.exe
Token: SeShutdownPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeSystemEnvironmentPrivilege	1764	powershell.exe
Token: SeRemoteShutdownPrivilege	1764	powershell.exe
Token: SeUndockPrivilege	1764	powershell.exe
Token: SeManageVolumePrivilege	1764	powershell.exe
Token: 33	1764	powershell.exe
Token: 34	1764	powershell.exe
Token: 35	1764	powershell.exe
Token: 36	1764	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeIncreaseQuotaPrivilege	1892	powershell.exe
Token: SeSecurityPrivilege	1892	powershell.exe
Token: SeTakeOwnershipPrivilege	1892	powershell.exe
Token: SeLoadDriverPrivilege	1892	powershell.exe
Token: SeSystemProfilePrivilege	1892	powershell.exe
Token: SeSystemtimePrivilege	1892	powershell.exe
Token: SeProfSingleProcessPrivilege	1892	powershell.exe
Token: SeIncBasePriorityPrivilege	1892	powershell.exe
Token: SeCreatePagefilePrivilege	1892	powershell.exe
Token: SeBackupPrivilege	1892	powershell.exe
Token: SeRestorePrivilege	1892	powershell.exe
Token: SeShutdownPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeSystemEnvironmentPrivilege	1892	powershell.exe
Token: SeRemoteShutdownPrivilege	1892	powershell.exe
Token: SeUndockPrivilege	1892	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3380	2156	teckzyy tweaks (4).exe	89
PID 3380 wrote to memory of 4312	3380	fortnitetweaks.exe	93
PID 4312 wrote to memory of 876	4312	fortnitetweaks.exe	94
PID 4312 wrote to memory of 4884	4312	fortnitetweaks.exe	98
PID 4312 wrote to memory of 3664	4312	fortnitetweaks.exe	100
PID 4312 wrote to memory of 2168	4312	fortnitetweaks.exe	103
PID 4312 wrote to memory of 1764	4312	fortnitetweaks.exe	105
PID 4312 wrote to memory of 1892	4312	fortnitetweaks.exe	107
PID 4312 wrote to memory of 436	4312	fortnitetweaks.exe	109
PID 4312 wrote to memory of 2772	4312	fortnitetweaks.exe	112
PID 4312 wrote to memory of 1408	4312	fortnitetweaks.exe	114
PID 4312 wrote to memory of 3944	4312	fortnitetweaks.exe	116
PID 4312 wrote to memory of 2940	4312	fortnitetweaks.exe	120
PID 4312 wrote to memory of 3400	4312	fortnitetweaks.exe	122
PID 4312 wrote to memory of 3692	4312	fortnitetweaks.exe	124
PID 4312 wrote to memory of 4748	4312	fortnitetweaks.exe	126
PID 4312 wrote to memory of 1368	4312	fortnitetweaks.exe	131
PID 1368 wrote to memory of 1044	1368	cmd.exe	133
PID 4312 wrote to memory of 2668	4312	fortnitetweaks.exe	135
PID 2668 wrote to memory of 3956	2668	cmd.exe	137
PID 4312 wrote to memory of 2120	4312	fortnitetweaks.exe	139
PID 4312 wrote to memory of 1172	4312	fortnitetweaks.exe	141
PID 4312 wrote to memory of 3860	4312	fortnitetweaks.exe	147
PID 4312 wrote to memory of 4984	4312	fortnitetweaks.exe	149
PID 1876 wrote to memory of 3864	1876	SecurityHealthService.exe	151
PID 4824 wrote to memory of 1944	4824	SecurityHealthService.exe	152
PID 3864 wrote to memory of 2236	3864	SecurityHealthService.exe	153
PID 1944 wrote to memory of 1268	1944	SecurityHealthService.exe	227
PID 4312 wrote to memory of 1332	4312	fortnitetweaks.exe	157
PID 1944 wrote to memory of 1016	1944	SecurityHealthService.exe	159
PID 3864 wrote to memory of 5088	3864	SecurityHealthService.exe	161
PID 3864 wrote to memory of 1572	3864	SecurityHealthService.exe	240
PID 1944 wrote to memory of 2720	1944	SecurityHealthService.exe	225
PID 4312 wrote to memory of 1416	4312	fortnitetweaks.exe	181
PID 3864 wrote to memory of 2164	3864	SecurityHealthService.exe	169
PID 4312 wrote to memory of 2144	4312	fortnitetweaks.exe	171
PID 1944 wrote to memory of 1952	1944	SecurityHealthService.exe	173
PID 3864 wrote to memory of 4936	3864	SecurityHealthService.exe	175
PID 4312 wrote to memory of 2480	4312	fortnitetweaks.exe	177
PID 1944 wrote to memory of 1688	1944	SecurityHealthService.exe	179
PID 4312 wrote to memory of 1416	4312	fortnitetweaks.exe	181
PID 3864 wrote to memory of 872	3864	SecurityHealthService.exe	183
PID 3864 wrote to memory of 2960	3864	SecurityHealthService.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\teckzyy tweaks (4).exe
"C:\Users\Admin\AppData\Local\Temp\teckzyy tweaks (4).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe"
    3⤵
    - Enumerates VirtualBox DLL files
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Looks for VMWare drivers on disk
    - Looks for VMWare services registry key.
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:876
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3664
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:436
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
      4⤵
      PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1408
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:3956
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2120
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1172
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4984
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1332
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2144
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4332
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1076
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2120
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1244
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Executes a command shell one-liner
      PID:3620
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3104
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5080
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2720
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1268
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe"
      4⤵
      Discovers running processes
      PID:4568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3632
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2428
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1128
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1572
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1700
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3524
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5064
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4440
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2944
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3932
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4752
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1708
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1268
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4676
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3572
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1444
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5040
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:116
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3712
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1836
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2168
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4656
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2208
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5048
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5056
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2236
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1656
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4092

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1268
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2720
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3028
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1496
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2904
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1292
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2464

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2236
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4936
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5080
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:3384
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4336
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2644
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2164
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2316
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 3104
    3⤵
    - Kills process with taskkill
    PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Debugger Evasion

T1622

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion