c7c3358383411e098dc43d45d149e38b14f11db7a2d677a156e1b977704d67d9

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	fortnitetweaks.exe

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	fortnitetweaks.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	fortnitetweaks.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	fortnitetweaks.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	fortnitetweaks.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3264	powershell.exe
6060	powershell.exe
3108	powershell.exe
2536	powershell.exe
2584	powershell.exe
3284	powershell.exe
4384	powershell.exe
4184	powershell.exe
3020	powershell.exe
4932	powershell.exe
3512	powershell.exe
5928	powershell.exe
2204	powershell.exe
2120	powershell.exe
4796	powershell.exe
1296	powershell.exe
4464	powershell.exe
4472	powershell.exe
1972	powershell.exe
568	powershell.exe
4660	powershell.exe
4100	powershell.exe
2772	powershell.exe
5640	powershell.exe
1892	powershell.exe
3140	powershell.exe
5060	powershell.exe
1556	powershell.exe
5936	powershell.exe
2684	powershell.exe
4700	powershell.exe
3360	powershell.exe
1792	powershell.exe
4588	powershell.exe
2584	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	fortnitetweaks.exe

Looks for VMWare drivers on disk 2 TTPs 4 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	fortnitetweaks.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	fortnitetweaks.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	fortnitetweaks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	fortnitetweaks.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	fortnitetweaks.exe

Executes dropped EXE 6 IoCs

pid	Process
4948	fortnitetweaks.exe
2176	fortnitetweaks.exe
236	SecurityHealthService.exe
3248	SecurityHealthService.exe
3572	SecurityHealthService.exe
3240	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
3572	SecurityHealthService.exe
3240	SecurityHealthService.exe
3572	SecurityHealthService.exe
3240	SecurityHealthService.exe
3572	SecurityHealthService.exe
3572	SecurityHealthService.exe
3240	SecurityHealthService.exe
3240	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	fortnitetweaks.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com
15	discord.com
16	discord.com
1	discord.com
8	discord.com
9	discord.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
11	api.ipify.org
19	api.ipify.org
20	api.ipify.org

Maps connected drives based on registry 3 TTPs 1 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fortnitetweaks.exe

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2572	tasklist.exe
4812	tasklist.exe
1320	tasklist.exe
5908	tasklist.exe
1672	tasklist.exe
3372	tasklist.exe
1260	tasklist.exe
2636	tasklist.exe
1196	tasklist.exe
2936	tasklist.exe
3808	tasklist.exe
2888	tasklist.exe
3488	tasklist.exe
2968	tasklist.exe
2952	tasklist.exe
3252	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5720	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

Debugger Evasion

T1622

pid	Process
2176	fortnitetweaks.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	fortnitetweaks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2532	cmd.exe
5180	cmd.exe
5644	cmd.exe
1784	cmd.exe
5656	cmd.exe
5528	cmd.exe
2696	cmd.exe
1736	cmd.exe
3412	cmd.exe
4520	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fortnitetweaks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fortnitetweaks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fortnitetweaks.exe

Kills process with taskkill 1 IoCs

pid	Process
3424	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
4932	powershell.exe
4932	powershell.exe
3140	powershell.exe
3140	powershell.exe
4660	powershell.exe
4660	powershell.exe
3924	wmic.exe
3924	wmic.exe
3924	wmic.exe
3924	wmic.exe
3264	powershell.exe
3264	powershell.exe
1792	powershell.exe
1792	powershell.exe
6060	powershell.exe
6060	powershell.exe
4384	powershell.exe
4384	powershell.exe
5060	powershell.exe
5060	powershell.exe
3512	powershell.exe
3512	powershell.exe
2176	fortnitetweaks.exe
2176	fortnitetweaks.exe
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe
2136	wmic.exe
2136	wmic.exe
2136	wmic.exe
2136	wmic.exe
4588	powershell.exe
4588	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	fortnitetweaks.exe
Token: SeDebugPrivilege	2572	tasklist.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeIncreaseQuotaPrivilege	4932	powershell.exe
Token: SeSecurityPrivilege	4932	powershell.exe
Token: SeTakeOwnershipPrivilege	4932	powershell.exe
Token: SeLoadDriverPrivilege	4932	powershell.exe
Token: SeSystemProfilePrivilege	4932	powershell.exe
Token: SeSystemtimePrivilege	4932	powershell.exe
Token: SeProfSingleProcessPrivilege	4932	powershell.exe
Token: SeIncBasePriorityPrivilege	4932	powershell.exe
Token: SeCreatePagefilePrivilege	4932	powershell.exe
Token: SeBackupPrivilege	4932	powershell.exe
Token: SeRestorePrivilege	4932	powershell.exe
Token: SeShutdownPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeSystemEnvironmentPrivilege	4932	powershell.exe
Token: SeRemoteShutdownPrivilege	4932	powershell.exe
Token: SeUndockPrivilege	4932	powershell.exe
Token: SeManageVolumePrivilege	4932	powershell.exe
Token: 33	4932	powershell.exe
Token: 34	4932	powershell.exe
Token: 35	4932	powershell.exe
Token: 36	4932	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	4660	powershell.exe
Token: SeSecurityPrivilege	4660	powershell.exe
Token: SeTakeOwnershipPrivilege	4660	powershell.exe
Token: SeLoadDriverPrivilege	4660	powershell.exe
Token: SeSystemProfilePrivilege	4660	powershell.exe
Token: SeSystemtimePrivilege	4660	powershell.exe
Token: SeProfSingleProcessPrivilege	4660	powershell.exe
Token: SeIncBasePriorityPrivilege	4660	powershell.exe
Token: SeCreatePagefilePrivilege	4660	powershell.exe
Token: SeBackupPrivilege	4660	powershell.exe
Token: SeRestorePrivilege	4660	powershell.exe
Token: SeShutdownPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeSystemEnvironmentPrivilege	4660	powershell.exe
Token: SeRemoteShutdownPrivilege	4660	powershell.exe
Token: SeUndockPrivilege	4660	powershell.exe
Token: SeManageVolumePrivilege	4660	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 4948	5964	teckzyy tweaks (4).exe	89
PID 4948 wrote to memory of 2176	4948	fortnitetweaks.exe	90
PID 2176 wrote to memory of 1736	2176	fortnitetweaks.exe	91
PID 2176 wrote to memory of 2572	2176	fortnitetweaks.exe	93
PID 2176 wrote to memory of 4932	2176	fortnitetweaks.exe	96
PID 2176 wrote to memory of 3140	2176	fortnitetweaks.exe	98
PID 2176 wrote to memory of 4660	2176	fortnitetweaks.exe	100
PID 2176 wrote to memory of 3924	2176	fortnitetweaks.exe	102
PID 2176 wrote to memory of 3264	2176	fortnitetweaks.exe	104
PID 2176 wrote to memory of 1672	2176	fortnitetweaks.exe	106
PID 2176 wrote to memory of 1792	2176	fortnitetweaks.exe	108
PID 2176 wrote to memory of 6060	2176	fortnitetweaks.exe	110
PID 2176 wrote to memory of 4384	2176	fortnitetweaks.exe	112
PID 2176 wrote to memory of 5060	2176	fortnitetweaks.exe	114
PID 2176 wrote to memory of 4812	2176	fortnitetweaks.exe	116
PID 2176 wrote to memory of 3512	2176	fortnitetweaks.exe	118
PID 2176 wrote to memory of 3412	2176	fortnitetweaks.exe	120
PID 3412 wrote to memory of 1196	3412	cmd.exe	122
PID 2176 wrote to memory of 5528	2176	fortnitetweaks.exe	123
PID 5528 wrote to memory of 2936	5528	cmd.exe	191
PID 2176 wrote to memory of 5296	2176	fortnitetweaks.exe	126
PID 2176 wrote to memory of 4100	2176	fortnitetweaks.exe	137
PID 2176 wrote to memory of 920	2176	fortnitetweaks.exe	133
PID 2176 wrote to memory of 4100	2176	fortnitetweaks.exe	137
PID 2176 wrote to memory of 1748	2176	fortnitetweaks.exe	139
PID 236 wrote to memory of 3572	236	SecurityHealthService.exe	141
PID 3248 wrote to memory of 3240	3248	SecurityHealthService.exe	142
PID 3572 wrote to memory of 4520	3572	SecurityHealthService.exe	143
PID 3240 wrote to memory of 2532	3240	SecurityHealthService.exe	145
PID 2176 wrote to memory of 2136	2176	fortnitetweaks.exe	147
PID 2176 wrote to memory of 1720	2176	fortnitetweaks.exe	149
PID 2176 wrote to memory of 4588	2176	fortnitetweaks.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\teckzyy tweaks (4).exe
"C:\Users\Admin\AppData\Local\Temp\teckzyy tweaks (4).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\fortnitetweaks.exe"
    3⤵
    - Enumerates VirtualBox DLL files
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Looks for VMWare drivers on disk
    - Looks for VMWare services registry key.
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:1736
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3264
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5060
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3412
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:2936
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5296
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4100
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4100
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1748
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2136
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4588
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3856
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4796
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:568
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Executes a command shell one-liner
      PID:5180
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5720
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3392
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe"
      4⤵
      Discovers running processes
      PID:3808
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2936
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5396
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2908
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:252
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:972
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1972
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1992
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4148
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4792
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2884
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4712
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1052
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5156
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3448
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5276
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1568
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2120
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4292
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3288

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4520
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3108
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:3868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2584
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5928
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:5656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2536
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /pid 5720
    3⤵
    - Kills process with taskkill
    PID:3424

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2532
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1296
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4700
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1784
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:2696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2888
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2444
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3284
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Debugger Evasion

T1622

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion