donutloader | 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71

Analysis

max time kernel
39s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient_protected.exe
Size 234KB
Sample261024-k87csays3j
SHA256 071b182afc551f116e0bad87839dd451673cb0e75f16cf1847fa66c4f15a9b71
MD5 870b0b55bf20894fd900663b3ada0680
SHA1 232877d12f76773ef1b4ac5f10d4262af158a38c
SHA512 5a4ab0080a82c85f895d07d3504e8be7fd86bc30809e1540b5b272389944d4de9ef083cff1a0f23d4940924080f9a64462470020446688b78c7e701ea5dff904
SSDEEP 6144:+/qK2eAFngHBY/263FPScKX1Y9jy7aQtyNU7jvQb:+/4rxgg2OOwuaI3
TLSH
T13E349C244A912521C28D82FF74270B15E7F8CA7E7323D35AEE2A06F3F9D16E74E91550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader neptunerat loader persistence privilege_escalation trojan

Malware Config

Extracted

Family

neptunerat

193.161.193.99:45108

Attributes

filename
USB.exe
group
MasonGroup
key
I3ujeNhtTGMSOz0g
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral4/memory/4488-34-0x0000027EBA500000-0x0000027EBA515000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 3 IoCs

resource	yara_rule
behavioral4/memory/4488-36-0x0000027EBA570000-0x0000027EBA582000-memory.dmp	family_neptunerat
behavioral4/memory/1280-258-0x000002235AFF0000-0x000002235B002000-memory.dmp	family_neptunerat
behavioral4/memory/1280-259-0x000002235AFF0000-0x000002235B002000-memory.dmp	family_neptunerat

Modifies visibility of hidden/system files in Explorer 2 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	k0tidnml.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	iuexaidg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fm2wcaqg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2mq14vqg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3qpjnmyo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3tnofs3a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lfaae3iw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	MasonClient_protected.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3vs1nyxi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vb3az2b0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vlmtaq41.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vuw01nmu.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wuibaql5.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4488 created 4684	4488	RuntimeBroker.exe	80
PID 4420 created 4684	4420	RuntimeBroker.exe	80

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6456	powershell.exe
4316	powershell.exe
1328	powershell.exe
4168	powershell.exe
6196	powershell.exe
6860	powershell.exe
6868	powershell.exe
1160	powershell.exe
6616	powershell.exe
4792	powershell.exe
7052	powershell.exe
200	powershell.exe
3404	powershell.exe
6484	powershell.exe
3208	powershell.exe
2344	powershell.exe
2316	powershell.exe
2592	powershell.exe
3532	powershell.exe
4896	powershell.exe
6468	powershell.exe
1352	powershell.exe
1800	powershell.exe
5836	powershell.exe
5764	powershell.exe
4908	powershell.exe
2524	powershell.exe
6580	powershell.exe
4164	powershell.exe
6220	powershell.exe
4768	powershell.exe
4804	powershell.exe
6772	powershell.exe
6604	powershell.exe
6084	powershell.exe
6624	powershell.exe
2616	powershell.exe
2692	powershell.exe
4360	powershell.exe
2612	powershell.exe
6792	powershell.exe
5536	powershell.exe
5840	powershell.exe
5372	powershell.exe
6684	powershell.exe
6968	powershell.exe
5164	powershell.exe
6672	powershell.exe
3756	powershell.exe
6772	powershell.exe
5908	powershell.exe
3452	powershell.exe
400	powershell.exe
5616	powershell.exe
4420	powershell.exe
920	powershell.exe
4660	powershell.exe
2784	powershell.exe
5736	powershell.exe
2540	powershell.exe
5264	powershell.exe
5996	powershell.exe
2120	powershell.exe
4128	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 14 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	3h1zdvep.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	hht1krwt.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	3vs1nyxi.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	vb3az2b0.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	vlmtaq41.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	3qpjnmyo.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	u5f2yxha.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	12mg4dvg.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	k0tidnml.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	iuexaidg.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	3tnofs3a.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	0o15syan.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	akyvsc2m.exe

Executes dropped EXE 20 IoCs

pid	Process
3256	lfaae3iw.exe
5188	RuntimeBroker.exe
4736	3vs1nyxi.exe
5404	k0tidnml.exe
2144	iuexaidg.exe
1388	vb3az2b0.exe
1472	vlmtaq41.exe
2104	fm2wcaqg.exe
3164	2mq14vqg.exe
2816	vuw01nmu.exe
4756	wuibaql5.exe
1780	3qpjnmyo.exe
1280	RuntimeBroker.exe
3128	3tnofs3a.exe
4972	0o15syan.exe
3240	akyvsc2m.exe
3276	3h1zdvep.exe
2148	hht1krwt.exe
4704	u5f2yxha.exe
880	12mg4dvg.exe

Adds Run key to start application 2 TTPs 39 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfaae3iw = "C:\\Users\\Admin\\AppData\\Roaming\\lfaae3iw.exe"	MasonClient_protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\3vs1nyxi = "C:\\Users\\Admin\\AppData\\Roaming\\3vs1nyxi.exe"	lfaae3iw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3vs1nyxi = "C:\\Users\\Admin\\AppData\\Roaming\\3vs1nyxi.exe"	lfaae3iw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\vb3az2b0 = "C:\\Users\\Admin\\AppData\\Roaming\\vb3az2b0.exe"	iuexaidg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3tnofs3a = "C:\\Users\\Admin\\AppData\\Roaming\\3tnofs3a.exe"	3qpjnmyo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\akyvsc2m = "C:\\Users\\Admin\\AppData\\Roaming\\akyvsc2m.exe"	0o15syan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2mq14vqg = "C:\\Users\\Admin\\AppData\\Roaming\\2mq14vqg.exe"	fm2wcaqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuw01nmu = "C:\\Users\\Admin\\AppData\\Roaming\\vuw01nmu.exe"	2mq14vqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuibaql5 = "C:\\Users\\Admin\\AppData\\Roaming\\wuibaql5.exe"	vuw01nmu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\3qpjnmyo = "C:\\Users\\Admin\\AppData\\Roaming\\3qpjnmyo.exe"	wuibaql5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\3tnofs3a = "C:\\Users\\Admin\\AppData\\Roaming\\3tnofs3a.exe"	3qpjnmyo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\0o15syan = "C:\\Users\\Admin\\AppData\\Roaming\\0o15syan.exe"	3tnofs3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3h1zdvep = "C:\\Users\\Admin\\AppData\\Roaming\\3h1zdvep.exe"	akyvsc2m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hht1krwt = "C:\\Users\\Admin\\AppData\\Roaming\\hht1krwt.exe"	3h1zdvep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\lfaae3iw = "C:\\Users\\Admin\\AppData\\Roaming\\lfaae3iw.exe"	MasonClient_protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\fm2wcaqg = "C:\\Users\\Admin\\AppData\\Roaming\\fm2wcaqg.exe"	vlmtaq41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuibaql5 = "C:\\Users\\Admin\\AppData\\Roaming\\wuibaql5.exe"	vuw01nmu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\u5f2yxha = "C:\\Users\\Admin\\AppData\\Roaming\\u5f2yxha.exe"	hht1krwt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\u5f2yxha = "C:\\Users\\Admin\\AppData\\Roaming\\u5f2yxha.exe"	hht1krwt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12mg4dvg = "C:\\Users\\Admin\\AppData\\Roaming\\12mg4dvg.exe"	u5f2yxha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vb3az2b0 = "C:\\Users\\Admin\\AppData\\Roaming\\vb3az2b0.exe"	iuexaidg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlmtaq41 = "C:\\Users\\Admin\\AppData\\Roaming\\vlmtaq41.exe"	vb3az2b0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuw01nmu = "C:\\Users\\Admin\\AppData\\Roaming\\vuw01nmu.exe"	2mq14vqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3qpjnmyo = "C:\\Users\\Admin\\AppData\\Roaming\\3qpjnmyo.exe"	wuibaql5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\3h1zdvep = "C:\\Users\\Admin\\AppData\\Roaming\\3h1zdvep.exe"	akyvsc2m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\k0tidnml = "C:\\Users\\Admin\\AppData\\Roaming\\k0tidnml.exe"	3vs1nyxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iuexaidg = "C:\\Users\\Admin\\AppData\\Roaming\\iuexaidg.exe"	k0tidnml.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\hht1krwt = "C:\\Users\\Admin\\AppData\\Roaming\\hht1krwt.exe"	3h1zdvep.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\12mg4dvg = "C:\\Users\\Admin\\AppData\\Roaming\\12mg4dvg.exe"	u5f2yxha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\k0tidnml = "C:\\Users\\Admin\\AppData\\Roaming\\k0tidnml.exe"	3vs1nyxi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlmtaq41 = "C:\\Users\\Admin\\AppData\\Roaming\\vlmtaq41.exe"	vb3az2b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fm2wcaqg = "C:\\Users\\Admin\\AppData\\Roaming\\fm2wcaqg.exe"	vlmtaq41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\2mq14vqg = "C:\\Users\\Admin\\AppData\\Roaming\\2mq14vqg.exe"	fm2wcaqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0o15syan = "C:\\Users\\Admin\\AppData\\Roaming\\0o15syan.exe"	3tnofs3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\akyvsc2m = "C:\\Users\\Admin\\AppData\\Roaming\\akyvsc2m.exe"	0o15syan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\iuexaidg = "C:\\Users\\Admin\\AppData\\Roaming\\iuexaidg.exe"	k0tidnml.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 28 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wuibaql5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3qpjnmyo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3tnofs3a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	k0tidnml.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	iuexaidg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vb3az2b0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3tnofs3a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lfaae3iw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lfaae3iw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MasonClient_protected.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MasonClient_protected.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2mq14vqg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vuw01nmu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wuibaql5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3qpjnmyo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	iuexaidg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vb3az2b0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vlmtaq41.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vlmtaq41.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fm2wcaqg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2mq14vqg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3vs1nyxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3vs1nyxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	k0tidnml.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fm2wcaqg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vuw01nmu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6104	schtasks.exe
4344	schtasks.exe
3184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
3480	MasonClient_protected.exe
4944	powershell.exe
4944	powershell.exe
3256	lfaae3iw.exe
3256	lfaae3iw.exe
3256	lfaae3iw.exe
3256	lfaae3iw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	MasonClient_protected.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	3256	lfaae3iw.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeIncreaseQuotaPrivilege	2592	powershell.exe
Token: SeSecurityPrivilege	2592	powershell.exe
Token: SeTakeOwnershipPrivilege	2592	powershell.exe
Token: SeLoadDriverPrivilege	2592	powershell.exe
Token: SeSystemProfilePrivilege	2592	powershell.exe
Token: SeSystemtimePrivilege	2592	powershell.exe
Token: SeProfSingleProcessPrivilege	2592	powershell.exe
Token: SeIncBasePriorityPrivilege	2592	powershell.exe
Token: SeCreatePagefilePrivilege	2592	powershell.exe
Token: SeBackupPrivilege	2592	powershell.exe
Token: SeRestorePrivilege	2592	powershell.exe
Token: SeShutdownPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeSystemEnvironmentPrivilege	2592	powershell.exe
Token: SeRemoteShutdownPrivilege	2592	powershell.exe
Token: SeUndockPrivilege	2592	powershell.exe
Token: SeManageVolumePrivilege	2592	powershell.exe
Token: 33	2592	powershell.exe
Token: 34	2592	powershell.exe
Token: 35	2592	powershell.exe
Token: 36	2592	powershell.exe
Token: SeDebugPrivilege	4488	RuntimeBroker.exe
Token: SeIncreaseQuotaPrivilege	4944	powershell.exe
Token: SeSecurityPrivilege	4944	powershell.exe
Token: SeTakeOwnershipPrivilege	4944	powershell.exe
Token: SeLoadDriverPrivilege	4944	powershell.exe
Token: SeSystemProfilePrivilege	4944	powershell.exe
Token: SeSystemtimePrivilege	4944	powershell.exe
Token: SeProfSingleProcessPrivilege	4944	powershell.exe
Token: SeIncBasePriorityPrivilege	4944	powershell.exe
Token: SeCreatePagefilePrivilege	4944	powershell.exe
Token: SeBackupPrivilege	4944	powershell.exe
Token: SeRestorePrivilege	4944	powershell.exe
Token: SeShutdownPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeSystemEnvironmentPrivilege	4944	powershell.exe
Token: SeRemoteShutdownPrivilege	4944	powershell.exe
Token: SeUndockPrivilege	4944	powershell.exe
Token: SeManageVolumePrivilege	4944	powershell.exe
Token: 33	4944	powershell.exe
Token: 34	4944	powershell.exe
Token: 35	4944	powershell.exe
Token: 36	4944	powershell.exe
Token: SeDebugPrivilege	4736	3vs1nyxi.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	5404	k0tidnml.exe
Token: SeIncreaseQuotaPrivilege	3776	powershell.exe
Token: SeSecurityPrivilege	3776	powershell.exe
Token: SeTakeOwnershipPrivilege	3776	powershell.exe
Token: SeLoadDriverPrivilege	3776	powershell.exe
Token: SeSystemProfilePrivilege	3776	powershell.exe
Token: SeSystemtimePrivilege	3776	powershell.exe
Token: SeProfSingleProcessPrivilege	3776	powershell.exe
Token: SeIncBasePriorityPrivilege	3776	powershell.exe
Token: SeCreatePagefilePrivilege	3776	powershell.exe
Token: SeBackupPrivilege	3776	powershell.exe
Token: SeRestorePrivilege	3776	powershell.exe
Token: SeShutdownPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeSystemEnvironmentPrivilege	3776	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4944	3480	MasonClient_protected.exe	89
PID 3256 wrote to memory of 2592	3256	lfaae3iw.exe	93
PID 3256 wrote to memory of 4488	3256	lfaae3iw.exe	60
PID 4488 wrote to memory of 6104	4488	RuntimeBroker.exe	96
PID 4736 wrote to memory of 3776	4736	3vs1nyxi.exe	103
PID 5404 wrote to memory of 2848	5404	k0tidnml.exe	107
PID 3480 wrote to memory of 4488	3480	MasonClient_protected.exe	60
PID 2144 wrote to memory of 4804	2144	iuexaidg.exe	112
PID 4736 wrote to memory of 4420	4736	3vs1nyxi.exe	59
PID 4420 wrote to memory of 4344	4420	RuntimeBroker.exe	115
PID 5404 wrote to memory of 4420	5404	k0tidnml.exe	59
PID 2144 wrote to memory of 5188	2144	iuexaidg.exe	100
PID 5188 wrote to memory of 3184	5188	RuntimeBroker.exe	117
PID 1388 wrote to memory of 1328	1388	vb3az2b0.exe	119
PID 1388 wrote to memory of 5188	1388	vb3az2b0.exe	100
PID 1472 wrote to memory of 3532	1472	vlmtaq41.exe	123
PID 2104 wrote to memory of 4168	2104	fm2wcaqg.exe	127
PID 3164 wrote to memory of 4896	3164	2mq14vqg.exe	131
PID 2816 wrote to memory of 5764	2816	vuw01nmu.exe	135
PID 4756 wrote to memory of 4360	4756	wuibaql5.exe	220
PID 4756 wrote to memory of 1280	4756	wuibaql5.exe	144
PID 2816 wrote to memory of 1280	2816	vuw01nmu.exe	144
PID 3164 wrote to memory of 1280	3164	2mq14vqg.exe	144
PID 1780 wrote to memory of 3452	1780	3qpjnmyo.exe	145
PID 3128 wrote to memory of 4908	3128	3tnofs3a.exe	149
PID 1780 wrote to memory of 1280	1780	3qpjnmyo.exe	144
PID 4972 wrote to memory of 5736	4972	0o15syan.exe	153
PID 3128 wrote to memory of 1280	3128	3tnofs3a.exe	144
PID 3240 wrote to memory of 4816	3240	akyvsc2m.exe	387
PID 3276 wrote to memory of 2540	3276	3h1zdvep.exe	161
PID 2148 wrote to memory of 400	2148	hht1krwt.exe	165
PID 4704 wrote to memory of 1816	4704	u5f2yxha.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Enumerates video capture drivers
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4684
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6104
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4344

C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient_protected.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lfaae3iw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944

C:\Users\Admin\AppData\Roaming\lfaae3iw.exe
C:\Users\Admin\AppData\Roaming\lfaae3iw.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3vs1nyxi.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2592

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3184

C:\Users\Admin\AppData\Roaming\3vs1nyxi.exe
C:\Users\Admin\AppData\Roaming\3vs1nyxi.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\k0tidnml.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3776

C:\Users\Admin\AppData\Roaming\k0tidnml.exe
C:\Users\Admin\AppData\Roaming\k0tidnml.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iuexaidg.exe"
  2⤵
  PID:2848

C:\Users\Admin\AppData\Roaming\iuexaidg.exe
C:\Users\Admin\AppData\Roaming\iuexaidg.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vb3az2b0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4804

C:\Users\Admin\AppData\Roaming\vb3az2b0.exe
C:\Users\Admin\AppData\Roaming\vb3az2b0.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlmtaq41.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1328

C:\Users\Admin\AppData\Roaming\vlmtaq41.exe
C:\Users\Admin\AppData\Roaming\vlmtaq41.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fm2wcaqg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3532

C:\Users\Admin\AppData\Roaming\fm2wcaqg.exe
C:\Users\Admin\AppData\Roaming\fm2wcaqg.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2mq14vqg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4168

C:\Users\Admin\AppData\Roaming\2mq14vqg.exe
C:\Users\Admin\AppData\Roaming\2mq14vqg.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vuw01nmu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4896

C:\Users\Admin\AppData\Roaming\vuw01nmu.exe
C:\Users\Admin\AppData\Roaming\vuw01nmu.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wuibaql5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5764

C:\Users\Admin\AppData\Roaming\wuibaql5.exe
C:\Users\Admin\AppData\Roaming\wuibaql5.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3qpjnmyo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4360

C:\Users\Admin\AppData\Roaming\3qpjnmyo.exe
C:\Users\Admin\AppData\Roaming\3qpjnmyo.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3tnofs3a.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3452

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:1280

C:\Users\Admin\AppData\Roaming\3tnofs3a.exe
C:\Users\Admin\AppData\Roaming\3tnofs3a.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0o15syan.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4908

C:\Users\Admin\AppData\Roaming\0o15syan.exe
C:\Users\Admin\AppData\Roaming\0o15syan.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\akyvsc2m.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5736

C:\Users\Admin\AppData\Roaming\akyvsc2m.exe
C:\Users\Admin\AppData\Roaming\akyvsc2m.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3h1zdvep.exe"
  2⤵
  PID:4816

C:\Users\Admin\AppData\Roaming\3h1zdvep.exe
C:\Users\Admin\AppData\Roaming\3h1zdvep.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hht1krwt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540

C:\Users\Admin\AppData\Roaming\hht1krwt.exe
C:\Users\Admin\AppData\Roaming\hht1krwt.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\u5f2yxha.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:400

C:\Users\Admin\AppData\Roaming\u5f2yxha.exe
C:\Users\Admin\AppData\Roaming\u5f2yxha.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\12mg4dvg.exe"
  2⤵
  PID:1816

C:\Users\Admin\AppData\Roaming\12mg4dvg.exe
C:\Users\Admin\AppData\Roaming\12mg4dvg.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\y4ztwrr4.exe"
  2⤵
  PID:1336

C:\Users\Admin\AppData\Roaming\y4ztwrr4.exe
C:\Users\Admin\AppData\Roaming\y4ztwrr4.exe
1⤵
PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hcfqartk.exe"
  2⤵
  PID:1008

C:\Users\Admin\AppData\Roaming\hcfqartk.exe
C:\Users\Admin\AppData\Roaming\hcfqartk.exe
1⤵
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3p2t2r3d.exe"
  2⤵
  PID:4948

C:\Users\Admin\AppData\Roaming\3p2t2r3d.exe
C:\Users\Admin\AppData\Roaming\3p2t2r3d.exe
1⤵
PID:6276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yxipd5wb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6468

C:\Users\Admin\AppData\Roaming\yxipd5wb.exe
C:\Users\Admin\AppData\Roaming\yxipd5wb.exe
1⤵
PID:6540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1eonp2xn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6772

C:\Users\Admin\AppData\Roaming\1eonp2xn.exe
C:\Users\Admin\AppData\Roaming\1eonp2xn.exe
1⤵
PID:6856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fcancjbr.exe"
  2⤵
  PID:7036

C:\Users\Admin\AppData\Roaming\fcancjbr.exe
C:\Users\Admin\AppData\Roaming\fcancjbr.exe
1⤵
PID:7124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\axa5z0w5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5908

C:\Users\Admin\AppData\Roaming\axa5z0w5.exe
C:\Users\Admin\AppData\Roaming\axa5z0w5.exe
1⤵
PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uiqzqs4q.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4792

C:\Users\Admin\AppData\Roaming\uiqzqs4q.exe
C:\Users\Admin\AppData\Roaming\uiqzqs4q.exe
1⤵
PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ky3tg3zq.exe"
  2⤵
  PID:5264

C:\Users\Admin\AppData\Roaming\ky3tg3zq.exe
C:\Users\Admin\AppData\Roaming\ky3tg3zq.exe
1⤵
PID:5676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1q5pn14s.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4316

C:\Users\Admin\AppData\Roaming\1q5pn14s.exe
C:\Users\Admin\AppData\Roaming\1q5pn14s.exe
1⤵
PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ubharor0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2524

C:\Users\Admin\AppData\Roaming\ubharor0.exe
C:\Users\Admin\AppData\Roaming\ubharor0.exe
1⤵
PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wkd2z3hh.exe"
  2⤵
  PID:4740

C:\Users\Admin\AppData\Roaming\wkd2z3hh.exe
C:\Users\Admin\AppData\Roaming\wkd2z3hh.exe
1⤵
PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\araeojxl.exe"
  2⤵
  PID:6632

C:\Users\Admin\AppData\Roaming\araeojxl.exe
C:\Users\Admin\AppData\Roaming\araeojxl.exe
1⤵
PID:6288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\itblkqpe.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7052

C:\Users\Admin\AppData\Roaming\itblkqpe.exe
C:\Users\Admin\AppData\Roaming\itblkqpe.exe
1⤵
PID:7104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\klhrf2a3.exe"
  2⤵
  PID:5716

C:\Users\Admin\AppData\Roaming\klhrf2a3.exe
C:\Users\Admin\AppData\Roaming\klhrf2a3.exe
1⤵
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cdzqdnqd.exe"
  2⤵
  PID:6708

C:\Users\Admin\AppData\Roaming\cdzqdnqd.exe
C:\Users\Admin\AppData\Roaming\cdzqdnqd.exe
1⤵
PID:4496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\33dh0qpe.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1352

C:\Users\Admin\AppData\Roaming\33dh0qpe.exe
C:\Users\Admin\AppData\Roaming\33dh0qpe.exe
1⤵
PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\f3jmqica.exe"
  2⤵
  PID:1076

C:\Users\Admin\AppData\Roaming\f3jmqica.exe
C:\Users\Admin\AppData\Roaming\f3jmqica.exe
1⤵
PID:5436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\l3b04vv4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5264

C:\Users\Admin\AppData\Roaming\l3b04vv4.exe
C:\Users\Admin\AppData\Roaming\l3b04vv4.exe
1⤵
PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ygt43jaq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5372

C:\Users\Admin\AppData\Roaming\ygt43jaq.exe
C:\Users\Admin\AppData\Roaming\ygt43jaq.exe
1⤵
PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vbge3ygh.exe"
  2⤵
  PID:6984

C:\Users\Admin\AppData\Roaming\vbge3ygh.exe
C:\Users\Admin\AppData\Roaming\vbge3ygh.exe
1⤵
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5iqktlbj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5996

C:\Users\Admin\AppData\Roaming\5iqktlbj.exe
C:\Users\Admin\AppData\Roaming\5iqktlbj.exe
1⤵
PID:6228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jnk2xdg2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:200

C:\Users\Admin\AppData\Roaming\jnk2xdg2.exe
C:\Users\Admin\AppData\Roaming\jnk2xdg2.exe
1⤵
PID:456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\e2syy3nr.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6684

C:\Users\Admin\AppData\Roaming\e2syy3nr.exe
C:\Users\Admin\AppData\Roaming\e2syy3nr.exe
1⤵
PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fxspgnxy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6968

C:\Users\Admin\AppData\Roaming\fxspgnxy.exe
C:\Users\Admin\AppData\Roaming\fxspgnxy.exe
1⤵
PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gvgivckj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6868

C:\Users\Admin\AppData\Roaming\gvgivckj.exe
C:\Users\Admin\AppData\Roaming\gvgivckj.exe
1⤵
PID:6964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vsefz25z.exe"
  2⤵
  PID:4408

C:\Users\Admin\AppData\Roaming\vsefz25z.exe
C:\Users\Admin\AppData\Roaming\vsefz25z.exe
1⤵
PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0ik4rxlg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1800

C:\Users\Admin\AppData\Roaming\0ik4rxlg.exe
C:\Users\Admin\AppData\Roaming\0ik4rxlg.exe
1⤵
PID:3796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bnmyubho.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5836

C:\Users\Admin\AppData\Roaming\bnmyubho.exe
C:\Users\Admin\AppData\Roaming\bnmyubho.exe
1⤵
PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kd42hxi4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5616

C:\Users\Admin\AppData\Roaming\kd42hxi4.exe
C:\Users\Admin\AppData\Roaming\kd42hxi4.exe
1⤵
PID:6300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\y4ogguyz.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2612

C:\Users\Admin\AppData\Roaming\y4ogguyz.exe
C:\Users\Admin\AppData\Roaming\y4ogguyz.exe
1⤵
PID:6156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kps3kjgb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6196

C:\Users\Admin\AppData\Roaming\kps3kjgb.exe
C:\Users\Admin\AppData\Roaming\kps3kjgb.exe
1⤵
PID:5176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1ulla4kv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4420

C:\Users\Admin\AppData\Roaming\1ulla4kv.exe
C:\Users\Admin\AppData\Roaming\1ulla4kv.exe
1⤵
PID:6564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oft2hne1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2344

C:\Users\Admin\AppData\Roaming\oft2hne1.exe
C:\Users\Admin\AppData\Roaming\oft2hne1.exe
1⤵
PID:5148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zl5uw4wh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2120

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
1⤵
PID:2160

C:\Users\Admin\AppData\Roaming\zl5uw4wh.exe
C:\Users\Admin\AppData\Roaming\zl5uw4wh.exe
1⤵
PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\csbljhjg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6604

C:\Users\Admin\AppData\Roaming\csbljhjg.exe
C:\Users\Admin\AppData\Roaming\csbljhjg.exe
1⤵
PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\u5e4gbga.exe"
  2⤵
  PID:1108

C:\Users\Admin\AppData\Roaming\u5e4gbga.exe
C:\Users\Admin\AppData\Roaming\u5e4gbga.exe
1⤵
PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jtws2rfs.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2316

C:\Users\Admin\AppData\Roaming\jtws2rfs.exe
C:\Users\Admin\AppData\Roaming\jtws2rfs.exe
1⤵
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zj2ll2ea.exe"
  2⤵
  PID:3992

C:\Users\Admin\AppData\Roaming\zj2ll2ea.exe
C:\Users\Admin\AppData\Roaming\zj2ll2ea.exe
1⤵
PID:6344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1hezmxr4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5164

C:\Users\Admin\AppData\Roaming\1hezmxr4.exe
C:\Users\Admin\AppData\Roaming\1hezmxr4.exe
1⤵
PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\n4inqkpc.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3404

C:\Users\Admin\AppData\Roaming\n4inqkpc.exe
C:\Users\Admin\AppData\Roaming\n4inqkpc.exe
1⤵
PID:5728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gvhvkrvj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6792

C:\Users\Admin\AppData\Roaming\gvhvkrvj.exe
C:\Users\Admin\AppData\Roaming\gvhvkrvj.exe
1⤵
PID:6816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\25nvtoh5.exe"
  2⤵
  PID:4152

C:\Users\Admin\AppData\Roaming\25nvtoh5.exe
C:\Users\Admin\AppData\Roaming\25nvtoh5.exe
1⤵
PID:7060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lvkz2o4r.exe"
  2⤵
  PID:6316

C:\Users\Admin\AppData\Roaming\lvkz2o4r.exe
C:\Users\Admin\AppData\Roaming\lvkz2o4r.exe
1⤵
PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2oevtlem.exe"
  2⤵
  PID:4780

C:\Users\Admin\AppData\Roaming\2oevtlem.exe
C:\Users\Admin\AppData\Roaming\2oevtlem.exe
1⤵
PID:6384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\i11okksv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6484

C:\Users\Admin\AppData\Roaming\i11okksv.exe
C:\Users\Admin\AppData\Roaming\i11okksv.exe
1⤵
PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\o5c0oc4i.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6580

C:\Users\Admin\AppData\Roaming\o5c0oc4i.exe
C:\Users\Admin\AppData\Roaming\o5c0oc4i.exe
1⤵
PID:7116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\guozk5nw.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:920

C:\Users\Admin\AppData\Roaming\guozk5nw.exe
C:\Users\Admin\AppData\Roaming\guozk5nw.exe
1⤵
PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lipd5bzq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3208

C:\Users\Admin\AppData\Roaming\lipd5bzq.exe
C:\Users\Admin\AppData\Roaming\lipd5bzq.exe
1⤵
PID:5264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\w50gztcf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1160

C:\Users\Admin\AppData\Roaming\w50gztcf.exe
C:\Users\Admin\AppData\Roaming\w50gztcf.exe
1⤵
PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\j4tzcwcl.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4164

C:\Users\Admin\AppData\Roaming\j4tzcwcl.exe
C:\Users\Admin\AppData\Roaming\j4tzcwcl.exe
1⤵
PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nk03vvbn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6860

C:\Users\Admin\AppData\Roaming\nk03vvbn.exe
C:\Users\Admin\AppData\Roaming\nk03vvbn.exe
1⤵
PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zyythz3h.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4128

C:\Users\Admin\AppData\Roaming\zyythz3h.exe
C:\Users\Admin\AppData\Roaming\zyythz3h.exe
1⤵
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4wo2h55o.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4816

C:\Users\Admin\AppData\Roaming\4wo2h55o.exe
C:\Users\Admin\AppData\Roaming\4wo2h55o.exe
1⤵
PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wghmocsm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6084

C:\Users\Admin\AppData\Roaming\wghmocsm.exe
C:\Users\Admin\AppData\Roaming\wghmocsm.exe
1⤵
PID:6224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fgll5svq.exe"
  2⤵
  PID:4252

C:\Users\Admin\AppData\Roaming\fgll5svq.exe
C:\Users\Admin\AppData\Roaming\fgll5svq.exe
1⤵
PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bfjq1fpf.exe"
  2⤵
  PID:5648

C:\Users\Admin\AppData\Roaming\bfjq1fpf.exe
C:\Users\Admin\AppData\Roaming\bfjq1fpf.exe
1⤵
PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zk2z4w41.exe"
  2⤵
  PID:6876

C:\Users\Admin\AppData\Roaming\zk2z4w41.exe
C:\Users\Admin\AppData\Roaming\zk2z4w41.exe
1⤵
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3sdz0bdh.exe"
  2⤵
  PID:3260

C:\Users\Admin\AppData\Roaming\3sdz0bdh.exe
C:\Users\Admin\AppData\Roaming\3sdz0bdh.exe
1⤵
PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ukvpdmkz.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6624

C:\Users\Admin\AppData\Roaming\ukvpdmkz.exe
C:\Users\Admin\AppData\Roaming\ukvpdmkz.exe
1⤵
PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qk1zsnhb.exe"
  2⤵
  PID:6184

C:\Users\Admin\AppData\Roaming\qk1zsnhb.exe
C:\Users\Admin\AppData\Roaming\qk1zsnhb.exe
1⤵
PID:6440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\j0rrxntj.exe"
  2⤵
  PID:4296

C:\Users\Admin\AppData\Roaming\j0rrxntj.exe
C:\Users\Admin\AppData\Roaming\j0rrxntj.exe
1⤵
PID:6216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gg52i2nf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6220

C:\Users\Admin\AppData\Roaming\gg52i2nf.exe
C:\Users\Admin\AppData\Roaming\gg52i2nf.exe
1⤵
PID:5736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cwfaooly.exe"
  2⤵
  PID:4136

C:\Users\Admin\AppData\Roaming\cwfaooly.exe
C:\Users\Admin\AppData\Roaming\cwfaooly.exe
1⤵
PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2gl5sc5p.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6672

C:\Users\Admin\AppData\Roaming\2gl5sc5p.exe
C:\Users\Admin\AppData\Roaming\2gl5sc5p.exe
1⤵
PID:3920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\w0efi2ak.exe"
  2⤵
  PID:4304

C:\Users\Admin\AppData\Roaming\w0efi2ak.exe
C:\Users\Admin\AppData\Roaming\w0efi2ak.exe
1⤵
PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ghcxy11a.exe"
  2⤵
  PID:3156

C:\Users\Admin\AppData\Roaming\ghcxy11a.exe
C:\Users\Admin\AppData\Roaming\ghcxy11a.exe
1⤵
PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ozel41x1.exe"
  2⤵
  PID:7016

C:\Users\Admin\AppData\Roaming\ozel41x1.exe
C:\Users\Admin\AppData\Roaming\ozel41x1.exe
1⤵
PID:6876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\2s3s3qtu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3756

C:\Users\Admin\AppData\Roaming\2s3s3qtu.exe
C:\Users\Admin\AppData\Roaming\2s3s3qtu.exe
1⤵
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1kngzdoa.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6616

C:\Users\Admin\AppData\Roaming\1kngzdoa.exe
C:\Users\Admin\AppData\Roaming\1kngzdoa.exe
1⤵
PID:6716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\llxddmn0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2784

C:\Users\Admin\AppData\Roaming\llxddmn0.exe
C:\Users\Admin\AppData\Roaming\llxddmn0.exe
1⤵
PID:6124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bqvhtocq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6772

C:\Users\Admin\AppData\Roaming\bqvhtocq.exe
C:\Users\Admin\AppData\Roaming\bqvhtocq.exe
1⤵
PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ifzk3cq5.exe"
  2⤵
  PID:5168

C:\Users\Admin\AppData\Roaming\ifzk3cq5.exe
C:\Users\Admin\AppData\Roaming\ifzk3cq5.exe
1⤵
PID:3988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdjt1jga.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2616

C:\Users\Admin\AppData\Roaming\bdjt1jga.exe
C:\Users\Admin\AppData\Roaming\bdjt1jga.exe
1⤵
PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yhemwj2l.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6456

C:\Users\Admin\AppData\Roaming\yhemwj2l.exe
C:\Users\Admin\AppData\Roaming\yhemwj2l.exe
1⤵
PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lofampbo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5536

C:\Users\Admin\AppData\Roaming\lofampbo.exe
C:\Users\Admin\AppData\Roaming\lofampbo.exe
1⤵
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\snupsktd.exe"
  2⤵
  PID:6984

C:\Users\Admin\AppData\Roaming\snupsktd.exe
C:\Users\Admin\AppData\Roaming\snupsktd.exe
1⤵
PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hoi45fot.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4768

C:\Users\Admin\AppData\Roaming\hoi45fot.exe
C:\Users\Admin\AppData\Roaming\hoi45fot.exe
1⤵
PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\x2zljd4b.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2692

C:\Users\Admin\AppData\Roaming\x2zljd4b.exe
C:\Users\Admin\AppData\Roaming\x2zljd4b.exe
1⤵
PID:6808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zgunhi2z.exe"
  2⤵
  PID:6624

C:\Users\Admin\AppData\Roaming\zgunhi2z.exe
C:\Users\Admin\AppData\Roaming\zgunhi2z.exe
1⤵
PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\033ojstk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5840

C:\Users\Admin\AppData\Roaming\033ojstk.exe
C:\Users\Admin\AppData\Roaming\033ojstk.exe
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact