xworm | 4960838a390adf1ea412850ca14f15ce7c201fa967c0089df97742ee517ed0fe

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cxtczt.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	cxtczt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\cxtczt.exe = "0"	cxtczt.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2720	powershell.exe
2648	powershell.exe
2936	powershell.exe
2232	powershell.exe
2888	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"cmd.exe\",\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe\""	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	cxtczt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	cxtczt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	cxtczt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	cxtczt.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	BootstrapperV21.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	BootstrapperV21.exe

Executes dropped EXE 5 IoCs

pid	Process
780	BootstrapperV21.exe
2500	Bootstrapper.exe
2088	explorer.exe
576	cxtczt.exe
2804	cxtczt.exe

Loads dropped DLL 7 IoCs

pid	Process
1724	Solara.exe
616	Process not Found
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	cxtczt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	cxtczt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\cxtczt.exe = "0"	cxtczt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe"	BootstrapperV21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Qwe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxtczt.exe"	cxtczt.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cxtczt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxtczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxtczt.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3004	schtasks.exe
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	powershell.exe
2720	powershell.exe
2648	powershell.exe
2936	powershell.exe
780	BootstrapperV21.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
2232	powershell.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe
576	cxtczt.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	Bootstrapper.exe
Token: SeDebugPrivilege	780	BootstrapperV21.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	780	BootstrapperV21.exe
Token: SeDebugPrivilege	2088	explorer.exe
Token: SeBackupPrivilege	576	cxtczt.exe
Token: SeRestorePrivilege	576	cxtczt.exe
Token: SeDebugPrivilege	576	cxtczt.exe
Token: SeShutdownPrivilege	1868	explorer.exe
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
780	BootstrapperV21.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 780	1724	Solara.exe	30
PID 1724 wrote to memory of 780	1724	Solara.exe	30
PID 1724 wrote to memory of 780	1724	Solara.exe	30
PID 1724 wrote to memory of 2500	1724	Solara.exe	31
PID 1724 wrote to memory of 2500	1724	Solara.exe	31
PID 1724 wrote to memory of 2500	1724	Solara.exe	31
PID 780 wrote to memory of 2888	780	BootstrapperV21.exe	33
PID 780 wrote to memory of 2888	780	BootstrapperV21.exe	33
PID 780 wrote to memory of 2888	780	BootstrapperV21.exe	33
PID 780 wrote to memory of 2720	780	BootstrapperV21.exe	35
PID 780 wrote to memory of 2720	780	BootstrapperV21.exe	35
PID 780 wrote to memory of 2720	780	BootstrapperV21.exe	35
PID 780 wrote to memory of 2648	780	BootstrapperV21.exe	37
PID 780 wrote to memory of 2648	780	BootstrapperV21.exe	37
PID 780 wrote to memory of 2648	780	BootstrapperV21.exe	37
PID 780 wrote to memory of 2936	780	BootstrapperV21.exe	39
PID 780 wrote to memory of 2936	780	BootstrapperV21.exe	39
PID 780 wrote to memory of 2936	780	BootstrapperV21.exe	39
PID 780 wrote to memory of 3004	780	BootstrapperV21.exe	42
PID 780 wrote to memory of 3004	780	BootstrapperV21.exe	42
PID 780 wrote to memory of 3004	780	BootstrapperV21.exe	42
PID 2500 wrote to memory of 1936	2500	Bootstrapper.exe	45
PID 2500 wrote to memory of 1936	2500	Bootstrapper.exe	45
PID 2500 wrote to memory of 1936	2500	Bootstrapper.exe	45
PID 1756 wrote to memory of 2088	1756	taskeng.exe	47
PID 1756 wrote to memory of 2088	1756	taskeng.exe	47
PID 1756 wrote to memory of 2088	1756	taskeng.exe	47
PID 780 wrote to memory of 576	780	BootstrapperV21.exe	48
PID 780 wrote to memory of 576	780	BootstrapperV21.exe	48
PID 780 wrote to memory of 576	780	BootstrapperV21.exe	48
PID 780 wrote to memory of 576	780	BootstrapperV21.exe	48
PID 576 wrote to memory of 2416	576	cxtczt.exe	50
PID 576 wrote to memory of 2416	576	cxtczt.exe	50
PID 576 wrote to memory of 2416	576	cxtczt.exe	50
PID 576 wrote to memory of 2416	576	cxtczt.exe	50
PID 576 wrote to memory of 2232	576	cxtczt.exe	51
PID 576 wrote to memory of 2232	576	cxtczt.exe	51
PID 576 wrote to memory of 2232	576	cxtczt.exe	51
PID 576 wrote to memory of 2232	576	cxtczt.exe	51
PID 2416 wrote to memory of 1748	2416	cmd.exe	54
PID 2416 wrote to memory of 1748	2416	cmd.exe	54
PID 2416 wrote to memory of 1748	2416	cmd.exe	54
PID 780 wrote to memory of 1296	780	BootstrapperV21.exe	55
PID 780 wrote to memory of 1296	780	BootstrapperV21.exe	55
PID 780 wrote to memory of 1296	780	BootstrapperV21.exe	55
PID 1756 wrote to memory of 2804	1756	taskeng.exe	57
PID 1756 wrote to memory of 2804	1756	taskeng.exe	57
PID 1756 wrote to memory of 2804	1756	taskeng.exe	57
PID 1756 wrote to memory of 2804	1756	taskeng.exe	57

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cxtczt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cxtczt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	cxtczt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV21.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV21.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BootstrapperV21.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BootstrapperV21.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\cxtczt.exe
    "C:\Users\Admin\AppData\Local\Temp\cxtczt.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:576
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\cxtczt.exe" /rl HIGHEST /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "GoogleUpdateTaskMachineUK" /sc MINUTE /mo 1 /tr "C:\Users\Admin\AppData\Local\Temp\cxtczt.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cxtczt.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2232
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "explorer"
    3⤵
    PID:1296
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2500 -s 1072
    3⤵
    - Loads dropped DLL
    PID:1936

C:\Windows\system32\taskeng.exe
taskeng.exe {095CC137-2BED-481F-B0C3-93229DF35FA0} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Roaming\explorer.exe
  C:\Users\Admin\AppData\Roaming\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\cxtczt.exe
  C:\Users\Admin\AppData\Local\Temp\cxtczt.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2804

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

DNS

getsolara.dev

Bootstrapper.exe

Remote address:

8.8.8.8:53

Request

getsolara.dev

IN A

Response

getsolara.dev

IN A

104.21.93.27

getsolara.dev

IN A

172.67.203.125
DNS

api.telegram.org

BootstrapperV21.exe

Remote address:

8.8.8.8:53

Request

api.telegram.org

IN A

Response

api.telegram.org

IN A

149.154.167.220
DNS

api.telegram.org

BootstrapperV21.exe

Remote address:

8.8.8.8:53

Request

api.telegram.org

IN A
DNS

cash-hispanic.gl.at.ply.gg

BootstrapperV21.exe

Remote address:

8.8.8.8:53

Request

cash-hispanic.gl.at.ply.gg

IN A

Response

cash-hispanic.gl.at.ply.gg

IN A

147.185.221.23

104.21.93.27:443

getsolara.dev

tls

Bootstrapper.exe

399 B
219 B
6
5
149.154.167.220:443

api.telegram.org

tls

BootstrapperV21.exe

440 B
219 B
6
5
127.0.0.1:1764

BootstrapperV21.exe
127.0.0.1:1764

BootstrapperV21.exe
147.185.221.23:1764

cash-hispanic.gl.at.ply.gg

BootstrapperV21.exe

13.9kB
664.4kB
283
536
147.185.221.23:1764

cash-hispanic.gl.at.ply.gg

BootstrapperV21.exe

4.1MB
66.3kB
3303
934

8.8.8.8:53

getsolara.dev

dns

Bootstrapper.exe

59 B
91 B
1
1

DNS Request

getsolara.dev

DNS Response

104.21.93.27

172.67.203.125
8.8.8.8:53

api.telegram.org

dns

BootstrapperV21.exe

124 B
78 B
2
1

DNS Request

api.telegram.org

DNS Request

api.telegram.org

DNS Response

149.154.167.220
8.8.8.8:53

cash-hispanic.gl.at.ply.gg

dns

BootstrapperV21.exe

72 B
88 B
1
1

DNS Request

cash-hispanic.gl.at.ply.gg

DNS Response

147.185.221.23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry