djvu | 7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BFED.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BFED.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BFED.exe

Deletes itself 1 IoCs

pid	Process
3176	Process not Found

Executes dropped EXE 8 IoCs

pid	Process
4376	B21E.exe
4360	B3E4.exe
3060	B3E4.exe
1388	BC23.exe
2812	BC23.exe
4568	B3E4.exe
3040	BFED.exe
3488	B3E4.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4260	icacls.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000800000001aed0-170.dat	themida
behavioral1/files/0x000800000001aed0-169.dat	themida
behavioral1/memory/3040-184-0x00000000000C0000-0x000000000074E000-memory.dmp	themida
behavioral1/memory/3040-238-0x00000000000C0000-0x000000000074E000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	34.142.181.181

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000600000001af08-367.dat	vmprotect
behavioral1/files/0x000700000001af0a-374.dat	vmprotect
behavioral1/files/0x000700000001af0a-377.dat	vmprotect
behavioral1/files/0x000700000001af0a-376.dat	vmprotect
behavioral1/files/0x000600000001af08-368.dat	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	B21E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5c9e72b4-2552-4e97-b5b4-d40404958ce4\\B3E4.exe\" --AutoStart"	B3E4.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BFED.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.2ip.ua
30	api.2ip.ua
74	api.2ip.ua
79	api.2ip.ua
6	api.2ip.ua
8	api.2ip.ua
21	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3040	BFED.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 3060	4360	B3E4.exe	68
PID 1388 set thread context of 2812	1388	BC23.exe	71
PID 4568 set thread context of 3488	4568	B3E4.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3344	4792	WerFault.exe	78
3120	5064	WerFault.exe	115
4224	1640	WerFault.exe	121

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2500	schtasks.exe
712	schtasks.exe
1544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3680	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe
3680	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3680	7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4376	3176	Process not Found	66
PID 3176 wrote to memory of 4376	3176	Process not Found	66
PID 3176 wrote to memory of 4376	3176	Process not Found	66
PID 3176 wrote to memory of 4360	3176	Process not Found	67
PID 3176 wrote to memory of 4360	3176	Process not Found	67
PID 3176 wrote to memory of 4360	3176	Process not Found	67
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 4360 wrote to memory of 3060	4360	B3E4.exe	68
PID 3060 wrote to memory of 4260	3060	B3E4.exe	69
PID 3060 wrote to memory of 4260	3060	B3E4.exe	69
PID 3060 wrote to memory of 4260	3060	B3E4.exe	69
PID 3176 wrote to memory of 1388	3176	Process not Found	70
PID 3176 wrote to memory of 1388	3176	Process not Found	70
PID 3176 wrote to memory of 1388	3176	Process not Found	70
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 1388 wrote to memory of 2812	1388	BC23.exe	71
PID 3060 wrote to memory of 4568	3060	B3E4.exe	73
PID 3060 wrote to memory of 4568	3060	B3E4.exe	73
PID 3060 wrote to memory of 4568	3060	B3E4.exe	73
PID 3176 wrote to memory of 3040	3176	Process not Found	74
PID 3176 wrote to memory of 3040	3176	Process not Found	74
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 4568 wrote to memory of 3488	4568	B3E4.exe	75
PID 3176 wrote to memory of 4172	3176	Process not Found	76
PID 3176 wrote to memory of 4172	3176	Process not Found	76
PID 3176 wrote to memory of 4172	3176	Process not Found	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe
"C:\Users\Admin\AppData\Local\Temp\7c5259715c7837c0598015e51d96161b0987dcedb06afdf305b0377865b97551.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3680

C:\Users\Admin\AppData\Local\Temp\B21E.exe
C:\Users\Admin\AppData\Local\Temp\B21E.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4376
- C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
  "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
  2⤵
  PID:3608

C:\Users\Admin\AppData\Local\Temp\B3E4.exe
C:\Users\Admin\AppData\Local\Temp\B3E4.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\B3E4.exe
  C:\Users\Admin\AppData\Local\Temp\B3E4.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\5c9e72b4-2552-4e97-b5b4-d40404958ce4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\sunwei.exe
      "C:\Users\Admin\AppData\Local\Temp\sunwei.exe" -h
      4⤵
      PID:3044
- - C:\Users\Admin\AppData\Local\Temp\B3E4.exe
    "C:\Users\Admin\AppData\Local\Temp\B3E4.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\B3E4.exe
      "C:\Users\Admin\AppData\Local\Temp\B3E4.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3488
    - - C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build2.exe
        
        "C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build2.exe"
        5⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build2.exe
        
        "C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build2.exe"
        6⤵
        
        PID:496
    - - C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build3.exe
        
        "C:\Users\Admin\AppData\Local\530eb5a5-c922-47a2-b81c-0b5f6a3b2f30\build3.exe"
        5⤵
        
        PID:1108
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2500

C:\Users\Admin\AppData\Local\Temp\BC23.exe
C:\Users\Admin\AppData\Local\Temp\BC23.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\BC23.exe
  C:\Users\Admin\AppData\Local\Temp\BC23.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\BC23.exe
    "C:\Users\Admin\AppData\Local\Temp\BC23.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:4492

C:\Users\Admin\AppData\Local\Temp\BFED.exe
C:\Users\Admin\AppData\Local\Temp\BFED.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:4984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:4988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:4112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:5116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:2108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:4708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:4196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:2112

C:\Users\Admin\AppData\Local\Temp\C80C.exe
C:\Users\Admin\AppData\Local\Temp\C80C.exe
1⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\CD6C.exe
C:\Users\Admin\AppData\Local\Temp\CD6C.exe
1⤵
PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 484
  2⤵
  - Program crash
  PID:3344

C:\Users\Admin\AppData\Local\Temp\BC23.exe
"C:\Users\Admin\AppData\Local\Temp\BC23.exe" --Admin IsNotAutoStart IsNotTask
1⤵
PID:4764
- C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build2.exe
  "C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build2.exe"
  2⤵
  PID:3532
- - C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build2.exe
    "C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build2.exe"
    3⤵
    PID:2484
- C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build3.exe
  "C:\Users\Admin\AppData\Local\738700b2-e897-4ff9-a4d2-a634e9b0f6ed\build3.exe"
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    3⤵
    - Creates scheduled task(s)
    PID:712

C:\Users\Admin\AppData\Local\Temp\22E0.exe
C:\Users\Admin\AppData\Local\Temp\22E0.exe
1⤵
PID:4240
- C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
  "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
  2⤵
  PID:3468
- C:\Users\Admin\AppData\Local\Temp\XandETC.exe
  "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\sunwei.exe
  "C:\Users\Admin\AppData\Local\Temp\sunwei.exe"
  2⤵
  PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:1244
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1544

C:\Users\Admin\AppData\Local\Temp\2B1E.exe
C:\Users\Admin\AppData\Local\Temp\2B1E.exe
1⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\311A.exe
C:\Users\Admin\AppData\Local\Temp\311A.exe
1⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\330F.exe
C:\Users\Admin\AppData\Local\Temp\330F.exe
1⤵
PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 484
  2⤵
  - Program crash
  PID:3120

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:4116

C:\Users\Admin\AppData\Local\Temp\5127.exe
C:\Users\Admin\AppData\Local\Temp\5127.exe
1⤵
PID:4196

C:\Users\Admin\AppData\Local\Temp\531C.exe
C:\Users\Admin\AppData\Local\Temp\531C.exe
1⤵
PID:1640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1640 -s 1492
  2⤵
  - Program crash
  PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WspService
1⤵
PID:200

C:\Users\Admin\AppData\Local\Temp\5A51.exe
C:\Users\Admin\AppData\Local\Temp\5A51.exe
1⤵
PID:2452
- C:\Users\Admin\AppData\Local\Temp\5A51.exe
  C:\Users\Admin\AppData\Local\Temp\5A51.exe
  2⤵
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\5A51.exe
    "C:\Users\Admin\AppData\Local\Temp\5A51.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\5A51.exe
      "C:\Users\Admin\AppData\Local\Temp\5A51.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:2200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery