fabookie | 8f1db790b8dcd0cfa72966ee8702bfd44c52600a290e40285b21bd6f356c12c5

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4324	netsh.exe
4020	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	file.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023202-49.dat	upx
behavioral2/files/0x0007000000023202-55.dat	upx
behavioral2/memory/3112-57-0x0000000000740000-0x0000000000C28000-memory.dmp	upx
behavioral2/files/0x0007000000023202-61.dat	upx
behavioral2/files/0x0007000000023202-77.dat	upx
behavioral2/files/0x0006000000023216-82.dat	upx
behavioral2/memory/3708-90-0x0000000000530000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/3708-91-0x0000000000530000-0x0000000000A18000-memory.dmp	upx
behavioral2/memory/4128-100-0x0000000000740000-0x0000000000C28000-memory.dmp	upx
behavioral2/files/0x0007000000023202-96.dat	upx
behavioral2/files/0x0007000000023202-140.dat	upx
behavioral2/memory/368-194-0x0000000000740000-0x0000000000C28000-memory.dmp	upx
behavioral2/memory/3112-239-0x0000000000740000-0x0000000000C28000-memory.dmp	upx
behavioral2/memory/4856-240-0x0000000000740000-0x0000000000C28000-memory.dmp	upx
behavioral2/memory/4128-248-0x0000000000740000-0x0000000000C28000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
19	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 1600	4976	file.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	3628	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2788	schtasks.exe
4200	schtasks.exe
3284	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4180	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	file.exe
Token: SeDebugPrivilege	1600	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1144	4976	file.exe	87
PID 4976 wrote to memory of 1144	4976	file.exe	87
PID 4976 wrote to memory of 1144	4976	file.exe	87
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89
PID 4976 wrote to memory of 1600	4976	file.exe	89

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- - C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe
    "C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe" --silent --allusers=0
    3⤵
    PID:3112
  - - C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe
      C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x2fc,0x6fdd9558,0x6fdd9564,0x6fdd9570
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\aghZpvIg5mM8rBtFyDsbyIif.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\aghZpvIg5mM8rBtFyDsbyIif.exe" --version
      4⤵
      PID:3708
  - - C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe
      "C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3112 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240126190519" --session-guid=87452b2d-8eea-4289-9335-18d26594a205 --server-tracking-blob=MTVhNmIzZGI3MWJhZGNmM2JiNGVmZmI0ZWY0YmI1Mzc1Y2E5ZWE5NTE2ODU2OWQwMjM3OTE2M2FhNzM3Njg4Mjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNjI5NTkxNy45MzIwIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJlMTBkOTgxZC1hMzRiLTQ3ODgtOTU2OS0zODQxMDUxMjQ3ZDUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0005000000000000
      4⤵
      PID:4128
    - - C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe
        
        C:\Users\Admin\Pictures\aghZpvIg5mM8rBtFyDsbyIif.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2bc,0x2ec,0x6eab9558,0x6eab9564,0x6eab9570
        5⤵
        
        PID:368
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\assistant_installer.exe" --version
      4⤵
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261905191\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xf92614,0xf92620,0xf9262c
        5⤵
        
        PID:3836
- - C:\Users\Admin\Pictures\19GLBlUCx8uHmSMF9JUeXn2d.exe
    "C:\Users\Admin\Pictures\19GLBlUCx8uHmSMF9JUeXn2d.exe"
    3⤵
    PID:1664
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:220
  - - C:\Users\Admin\Pictures\19GLBlUCx8uHmSMF9JUeXn2d.exe
      "C:\Users\Admin\Pictures\19GLBlUCx8uHmSMF9JUeXn2d.exe"
      4⤵
      PID:2508
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4976
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:568
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5084
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:232
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2204
- - C:\Users\Admin\Pictures\37xk2AXOITRCj599MQzVTCue.exe
    "C:\Users\Admin\Pictures\37xk2AXOITRCj599MQzVTCue.exe"
    3⤵
    PID:696
- - C:\Users\Admin\Pictures\5sGO6cjPnivgbUIzdq48h2WR.exe
    "C:\Users\Admin\Pictures\5sGO6cjPnivgbUIzdq48h2WR.exe"
    3⤵
    PID:448
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2584
  - - C:\Users\Admin\Pictures\5sGO6cjPnivgbUIzdq48h2WR.exe
      "C:\Users\Admin\Pictures\5sGO6cjPnivgbUIzdq48h2WR.exe"
      4⤵
      PID:3624
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3844
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5088
- - C:\Users\Admin\Pictures\vKOsDKGSLuoLJn0nZjW09XJX.exe
    "C:\Users\Admin\Pictures\vKOsDKGSLuoLJn0nZjW09XJX.exe"
    3⤵
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        5⤵
        
        PID:1724
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:232
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        6⤵
        Creates scheduled task(s)
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\nsr9647.tmp
      C:\Users\Admin\AppData\Local\Temp\nsr9647.tmp
      4⤵
      PID:3628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsr9647.tmp" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:64
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:4180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 3184
        5⤵
        Program crash
        
        PID:2032
- - C:\Users\Admin\Pictures\kKJeBSpGJVEbmOFKNgvo808x.exe
    "C:\Users\Admin\Pictures\kKJeBSpGJVEbmOFKNgvo808x.exe"
    3⤵
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\7zS89D1.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\7zS920E.tmp\Install.exe
        
        .\Install.exe /LzfYdidLoSR "385118" /S
        5⤵
        
        PID:4576
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:1824
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:4508
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gKQfUAZqw" /SC once /ST 04:40:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:3284
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gKQfUAZqw"
        6⤵
        
        PID:4700
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gKQfUAZqw"
        6⤵
        
        PID:4924
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bmfUAJAHieefCXsdaD" /SC once /ST 19:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\gxryimq.exe\" hp /Cjsite_idZiT 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:2788
- - C:\Users\Admin\Pictures\KDdu1G7TBXwAcsx5Yzqy2r5r.exe
    "C:\Users\Admin\Pictures\KDdu1G7TBXwAcsx5Yzqy2r5r.exe" PeJj3z5KgQO+REOMHfxRWZMfrERTkhHmRUWETPcQX9Iwim5oqDrINyf9NcQnEA==
    3⤵
    PID:1720
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4020

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:3596

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
1⤵
PID:5112

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
1⤵
PID:4560

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
1⤵
PID:4232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2672
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4700

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3628 -ip 3628
1⤵
PID:2288

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry