1efa01ffacc75ec629997d734cce16a8e28a7abf31ab40a247996c56130e5efc

Analysis

max time kernel
108s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
marco.exe
Size 956KB
Sample261001-vynsssscke
SHA256 1efa01ffacc75ec629997d734cce16a8e28a7abf31ab40a247996c56130e5efc
MD5 22aafadd7963e499a1efa37c5150bdc6
SHA1 17baf2e29f93f2ed051e5d56f5065d288e713fc9
SHA512 c4e220aa6bab1e05705d2a79709f61f773659b01fc6db7accca3c64695cc9523c207175ac9b44af51bcc9a06c25000d53a5505c6a7f40c74bccf0f41b9c0fe41
SSDEEP 12288:NF+NLmQri4dziSs5c/sZisjxalrYbe9Xq0j4Px8IYTz8dPXZrwvmS:CLxhfstiJq0gLizTvmS
TLSH
T15B256C26F6A900BDD0B6C1B5C9134903E772784A47317ADF07906AA71F27BE49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3500	wuausvhost.exe
5328	wuausvhost.exe
5500	wuausvhost.exe

Loads dropped DLL 1 IoCs

pid	Process
3108	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\UsoSessionWorker = "\"C:\\Windows\\system32\\wuausvhost.exe\""	marco.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1644	powershell.exe
4212	powershell.exe
3296	powershell.exe
4284	powershell.exe
1168	powershell.exe
2648	powershell.exe
4248	powershell.exe
4244	powershell.exe
2208	powershell.exe
1512	powershell.exe
4568	powershell.exe
5888	powershell.exe
3356	powershell.exe
4220	powershell.exe
4532	powershell.exe
1384	powershell.exe
5832	powershell.exe
3480	powershell.exe
1732	powershell.exe
4704	powershell.exe
5452	powershell.exe
3508	powershell.exe
4636	powershell.exe
3240	powershell.exe
5732	powershell.exe
2080	powershell.exe
5372	powershell.exe
5568	powershell.exe
4500	powershell.exe
3332	powershell.exe
2504	powershell.exe
3776	powershell.exe

Enumerates connected drives 3 TTPs 13 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\wuausvhost.exe	marco.exe
File opened for modification	C:\Windows\system32\wuausvhost.exe	marco.exe
File created	C:\Windows\system32\wlbsctrl.dll	marco.exe
File opened for modification	C:\Windows\system32\wlbsctrl.dll	marco.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 32 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3480	powershell.exe
3240	powershell.exe
1732	powershell.exe
4704	powershell.exe
4500	powershell.exe
5832	powershell.exe
3508	powershell.exe
5372	powershell.exe
4636	powershell.exe
5732	powershell.exe
1384	powershell.exe
4244	powershell.exe
2208	powershell.exe
3776	powershell.exe
5888	powershell.exe
3356	powershell.exe
2080	powershell.exe
5452	powershell.exe
4284	powershell.exe
1512	powershell.exe
3296	powershell.exe
3332	powershell.exe
4248	powershell.exe
2504	powershell.exe
2648	powershell.exe
1644	powershell.exe
4212	powershell.exe
5568	powershell.exe
1168	powershell.exe
4568	powershell.exe
4220	powershell.exe
4532	powershell.exe

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
240	cmd.exe
5288	cmd.exe
4644	cmd.exe
4472	cmd.exe
5616	cmd.exe
5060	cmd.exe
4888	cmd.exe
5704	cmd.exe
2228	cmd.exe
4624	cmd.exe
2368	cmd.exe
3828	cmd.exe
5664	cmd.exe
3320	cmd.exe
5024	cmd.exe
6080	cmd.exe
4496	cmd.exe
4660	cmd.exe
4196	cmd.exe
3044	cmd.exe
244	cmd.exe
5772	cmd.exe
4628	cmd.exe
3780	cmd.exe
988	cmd.exe
5096	cmd.exe
3376	cmd.exe
2472	cmd.exe
1252	cmd.exe
5108	cmd.exe
2696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	marco.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	marco.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5328	wuausvhost.exe
5328	wuausvhost.exe
3500	wuausvhost.exe
3500	wuausvhost.exe
1384	marco.exe
1384	marco.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
5500	wuausvhost.exe
5500	wuausvhost.exe
2208	powershell.exe
2208	powershell.exe
5372	powershell.exe
5372	powershell.exe
5372	powershell.exe
2208	powershell.exe
4284	powershell.exe
4284	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
5568	powershell.exe
5568	powershell.exe
4636	powershell.exe
1168	powershell.exe
4636	powershell.exe
4636	powershell.exe
1168	powershell.exe
1168	powershell.exe
3240	powershell.exe
3240	powershell.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe
4704	powershell.exe
4704	powershell.exe
4500	powershell.exe
4500	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5412	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAuditPrivilege	3108	svchost.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	5832	powershell.exe
Token: SeSecurityPrivilege	5832	powershell.exe
Token: SeTakeOwnershipPrivilege	5832	powershell.exe
Token: SeLoadDriverPrivilege	5832	powershell.exe
Token: SeSystemProfilePrivilege	5832	powershell.exe
Token: SeSystemtimePrivilege	5832	powershell.exe
Token: SeProfSingleProcessPrivilege	5832	powershell.exe
Token: SeIncBasePriorityPrivilege	5832	powershell.exe
Token: SeCreatePagefilePrivilege	5832	powershell.exe
Token: SeBackupPrivilege	5832	powershell.exe
Token: SeRestorePrivilege	5832	powershell.exe
Token: SeShutdownPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeSystemEnvironmentPrivilege	5832	powershell.exe
Token: SeRemoteShutdownPrivilege	5832	powershell.exe
Token: SeUndockPrivilege	5832	powershell.exe
Token: SeManageVolumePrivilege	5832	powershell.exe
Token: 33	5832	powershell.exe
Token: 34	5832	powershell.exe
Token: 35	5832	powershell.exe
Token: 36	5832	powershell.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeShutdownPrivilege	5412	explorer.exe
Token: SeCreatePagefilePrivilege	5412	explorer.exe
Token: SeIncreaseQuotaPrivilege	2208	powershell.exe
Token: SeSecurityPrivilege	2208	powershell.exe
Token: SeTakeOwnershipPrivilege	2208	powershell.exe
Token: SeLoadDriverPrivilege	2208	powershell.exe
Token: SeSystemProfilePrivilege	2208	powershell.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
5412	explorer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 5328	3108	svchost.exe	92
PID 5328 wrote to memory of 5412	5328	wuausvhost.exe	82
PID 5328 wrote to memory of 5412	5328	wuausvhost.exe	82
PID 3500 wrote to memory of 5412	3500	wuausvhost.exe	82
PID 3500 wrote to memory of 5412	3500	wuausvhost.exe	82
PID 1384 wrote to memory of 5412	1384	marco.exe	82
PID 1384 wrote to memory of 5412	1384	marco.exe	82
PID 5412 wrote to memory of 252	5412	explorer.exe
PID 5412 wrote to memory of 2472	5412	explorer.exe	95
PID 2472 wrote to memory of 5832	2472	cmd.exe	97
PID 5412 wrote to memory of 5024	5412	explorer.exe	98
PID 5024 wrote to memory of 3508	5024	cmd.exe	100
PID 5500 wrote to memory of 5412	5500	wuausvhost.exe	82
PID 5500 wrote to memory of 5412	5500	wuausvhost.exe	82
PID 5412 wrote to memory of 5096	5412	explorer.exe	104
PID 5412 wrote to memory of 6080	5412	explorer.exe	103
PID 6080 wrote to memory of 2208	6080	cmd.exe	107
PID 5096 wrote to memory of 5372	5096	cmd.exe	108
PID 5412 wrote to memory of 4496	5412	explorer.exe	109
PID 4496 wrote to memory of 4284	4496	cmd.exe	111
PID 5412 wrote to memory of 244	5412	explorer.exe	112
PID 244 wrote to memory of 3480	244	cmd.exe	114
PID 5412 wrote to memory of 3376	5412	explorer.exe	115
PID 3376 wrote to memory of 5568	3376	cmd.exe	117
PID 5412 wrote to memory of 5772	5412	explorer.exe	118
PID 5412 wrote to memory of 5664	5412	explorer.exe	120
PID 5772 wrote to memory of 1168	5772	cmd.exe	122
PID 5664 wrote to memory of 4636	5664	cmd.exe	123
PID 5412 wrote to memory of 1252	5412	explorer.exe	124
PID 1252 wrote to memory of 3240	1252	cmd.exe	126
PID 5412 wrote to memory of 4624	5412	explorer.exe	127
PID 4624 wrote to memory of 1732	4624	cmd.exe	129
PID 5412 wrote to memory of 4660	5412	explorer.exe	130
PID 4660 wrote to memory of 4704	4660	cmd.exe	132
PID 5412 wrote to memory of 4644	5412	explorer.exe	133
PID 4644 wrote to memory of 4500	4644	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\AppData\Local\Temp\marco.exe
  "C:\Users\Admin\AppData\Local\Temp\marco.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:1168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:4472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:3776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:5616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:5108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:2648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:5060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:5888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:3332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:4820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:5452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:2228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\system32\wuausvhost.exe
  "C:\Windows\system32\wuausvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5328

C:\Windows\system32\wuausvhost.exe
C:\Windows\system32\wuausvhost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\system32\wuausvhost.exe
"C:\Windows\system32\wuausvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact