187dda8694b772e25a3fb7907b9ed7880e83df1a88acb9cc287d08e9ecb57260

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	smss64.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	smss64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	smss64.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/memory/5004-62-0x00000000014D0000-0x0000000001549000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/5004-82-0x00000000014D0000-0x0000000001549000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/5004-62-0x00000000014D0000-0x0000000001549000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243b6-17.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243b6-17.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5332	powershell.exe
5296	powershell.exe
5332	powershell.exe
5296	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
5004	smss64.exe
4188	smss64.exe
3480	smss64.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Loads dropped DLL 3 IoCs

pid	Process
5004	smss64.exe
4188	smss64.exe
3480	smss64.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

pid	Process
4892	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetPerformanceLog = "C:\\ProgramData\\Microsoft\\NetPerformanceLog\\smss64.exe"	smss64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
4892	cmd.exe
1140	cmd.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4848	sc.exe
3824	sc.exe
3160	sc.exe
4640	sc.exe
1520	sc.exe
5196	sc.exe
856	sc.exe
472	sc.exe
4000	sc.exe
2152	sc.exe
5320	sc.exe
3332	sc.exe
4372	sc.exe
5936	sc.exe
440	sc.exe
5824	sc.exe
2560	sc.exe
5336	sc.exe
4676	sc.exe
1028	sc.exe
624	sc.exe
1376	sc.exe
5360	sc.exe
4104	sc.exe
992	sc.exe
5172	sc.exe
6068	sc.exe
4316	sc.exe
3476	sc.exe
4228	sc.exe
4168	sc.exe
5600	sc.exe
3728	sc.exe
3076	sc.exe
1772	sc.exe
1060	sc.exe
4284	sc.exe
220	sc.exe
1884	sc.exe
5508	sc.exe
5196	sc.exe
5932	sc.exe
5064	sc.exe
5964	sc.exe
3568	sc.exe
5060	sc.exe
4016	sc.exe
3084	sc.exe
5964	sc.exe
4168	sc.exe
2812	sc.exe
4476	sc.exe
3428	sc.exe
4304	sc.exe
5344	sc.exe
3080	sc.exe
3764	sc.exe
1940	sc.exe
5064	sc.exe
1588	sc.exe
4428	sc.exe
3384	sc.exe
4940	sc.exe
760	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4956	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4956	netstat.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32	smss64.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID	smss64.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}	smss64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\NetPerformanceLog\\dnssd.dll"	smss64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ThreadingModel = "Both"	smss64.exe

Modifies registry key 1 TTPs 51 IoCs

Modify Registry

pid	Process
216	reg.exe
5364	reg.exe
4232	reg.exe
5236	reg.exe
1096	reg.exe
5552	reg.exe
4964	reg.exe
1064	reg.exe
1980	reg.exe
4912	reg.exe
3592	reg.exe
1988	reg.exe
4216	reg.exe
5588	reg.exe
5740	reg.exe
2428	reg.exe
4292	reg.exe
4916	reg.exe
4608	reg.exe
5648	reg.exe
4852	reg.exe
1004	reg.exe
2572	reg.exe
4360	reg.exe
5312	reg.exe
5808	reg.exe
5932	reg.exe
3364	reg.exe
2308	reg.exe
2416	reg.exe
2116	reg.exe
4836	reg.exe
4520	reg.exe
5868	reg.exe
5212	reg.exe
4316	reg.exe
1652	reg.exe
3412	reg.exe
3568	reg.exe
4688	reg.exe
4408	reg.exe
2560	reg.exe
4348	reg.exe
4588	reg.exe
1488	reg.exe
3340	reg.exe
64	reg.exe
4668	reg.exe
5724	reg.exe
5636	reg.exe
6036	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5004	smss64.exe
5004	smss64.exe
5332	powershell.exe
5332	powershell.exe
5296	powershell.exe
5296	powershell.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe
5004	smss64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5276	WMIC.exe
Token: SeSecurityPrivilege	5276	WMIC.exe
Token: SeTakeOwnershipPrivilege	5276	WMIC.exe
Token: SeLoadDriverPrivilege	5276	WMIC.exe
Token: SeSystemProfilePrivilege	5276	WMIC.exe
Token: SeSystemtimePrivilege	5276	WMIC.exe
Token: SeProfSingleProcessPrivilege	5276	WMIC.exe
Token: SeIncBasePriorityPrivilege	5276	WMIC.exe
Token: SeCreatePagefilePrivilege	5276	WMIC.exe
Token: SeBackupPrivilege	5276	WMIC.exe
Token: SeRestorePrivilege	5276	WMIC.exe
Token: SeShutdownPrivilege	5276	WMIC.exe
Token: SeDebugPrivilege	5276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5276	WMIC.exe
Token: SeRemoteShutdownPrivilege	5276	WMIC.exe
Token: SeUndockPrivilege	5276	WMIC.exe
Token: SeManageVolumePrivilege	5276	WMIC.exe
Token: 33	5276	WMIC.exe
Token: 34	5276	WMIC.exe
Token: 35	5276	WMIC.exe
Token: 36	5276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5276	WMIC.exe
Token: SeSecurityPrivilege	5276	WMIC.exe
Token: SeTakeOwnershipPrivilege	5276	WMIC.exe
Token: SeLoadDriverPrivilege	5276	WMIC.exe
Token: SeSystemProfilePrivilege	5276	WMIC.exe
Token: SeSystemtimePrivilege	5276	WMIC.exe
Token: SeProfSingleProcessPrivilege	5276	WMIC.exe
Token: SeIncBasePriorityPrivilege	5276	WMIC.exe
Token: SeCreatePagefilePrivilege	5276	WMIC.exe
Token: SeBackupPrivilege	5276	WMIC.exe
Token: SeRestorePrivilege	5276	WMIC.exe
Token: SeShutdownPrivilege	5276	WMIC.exe
Token: SeDebugPrivilege	5276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5276	WMIC.exe
Token: SeRemoteShutdownPrivilege	5276	WMIC.exe
Token: SeUndockPrivilege	5276	WMIC.exe
Token: SeManageVolumePrivilege	5276	WMIC.exe
Token: 33	5276	WMIC.exe
Token: 34	5276	WMIC.exe
Token: 35	5276	WMIC.exe
Token: 36	5276	WMIC.exe
Token: SeDebugPrivilege	4956	netstat.exe
Token: SeSecurityPrivilege	2436	mofcomp.exe
Token: SeDebugPrivilege	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Token: SeSecurityPrivilege	4308	mofcomp.exe
Token: SeSecurityPrivilege	4228	mofcomp.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5296	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4660	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	84
PID 4660 wrote to memory of 560	4660	cmd.exe	86
PID 4140 wrote to memory of 2808	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	87
PID 4140 wrote to memory of 5716	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	89
PID 4140 wrote to memory of 3984	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	91
PID 4140 wrote to memory of 3764	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	93
PID 4140 wrote to memory of 5600	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	95
PID 4140 wrote to memory of 2336	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	97
PID 4140 wrote to memory of 2852	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	99
PID 4140 wrote to memory of 5968	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	101
PID 4140 wrote to memory of 5964	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	103
PID 4140 wrote to memory of 4940	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	105
PID 4140 wrote to memory of 1052	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	107
PID 4140 wrote to memory of 2100	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	109
PID 4140 wrote to memory of 1416	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	111
PID 4140 wrote to memory of 5632	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	113
PID 4140 wrote to memory of 4572	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	115
PID 4140 wrote to memory of 1464	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	117
PID 4140 wrote to memory of 3816	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	119
PID 4140 wrote to memory of 4088	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	121
PID 4140 wrote to memory of 4560	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	123
PID 4140 wrote to memory of 3416	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	125
PID 4140 wrote to memory of 1048	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	127
PID 4140 wrote to memory of 4016	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	129
PID 4140 wrote to memory of 5604	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	131
PID 4140 wrote to memory of 5580	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	133
PID 4140 wrote to memory of 5824	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	135
PID 4140 wrote to memory of 2152	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	137
PID 4140 wrote to memory of 5256	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	139
PID 4140 wrote to memory of 3524	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	141
PID 4140 wrote to memory of 760	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	143
PID 4140 wrote to memory of 624	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	145
PID 4140 wrote to memory of 5644	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	147
PID 4140 wrote to memory of 1940	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	149
PID 4140 wrote to memory of 1140	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	151
PID 4140 wrote to memory of 3728	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	153
PID 4140 wrote to memory of 4848	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	155
PID 4140 wrote to memory of 5060	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	157
PID 4140 wrote to memory of 4640	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	159
PID 4140 wrote to memory of 4676	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	161
PID 4140 wrote to memory of 4168	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	163
PID 4140 wrote to memory of 1520	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	165
PID 4140 wrote to memory of 5408	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	167
PID 4140 wrote to memory of 5612	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	169
PID 4140 wrote to memory of 5940	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	171
PID 4140 wrote to memory of 5428	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	173
PID 4140 wrote to memory of 5064	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	175
PID 4140 wrote to memory of 3588	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	177
PID 4140 wrote to memory of 3268	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	179
PID 4140 wrote to memory of 5740	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	181
PID 4140 wrote to memory of 4316	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	183
PID 4140 wrote to memory of 1616	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	185
PID 4140 wrote to memory of 6004	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	187
PID 4140 wrote to memory of 1772	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	189
PID 4140 wrote to memory of 2544	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	191
PID 4140 wrote to memory of 4392	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	193
PID 4140 wrote to memory of 5320	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	195
PID 4140 wrote to memory of 1640	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	197
PID 4140 wrote to memory of 1856	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	199
PID 4140 wrote to memory of 5412	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	201
PID 4140 wrote to memory of 6044	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	203
PID 4140 wrote to memory of 4964	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	205
PID 4140 wrote to memory of 4420	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	207
PID 4140 wrote to memory of 2304	4140	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc query type= service state= all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\sc.exe
    sc query type= service state= all
    3⤵
    PID:560
- C:\Windows\system32\sc.exe
  "sc" qc AJRouter
  2⤵
  PID:2808
- C:\Windows\system32\sc.exe
  "sc" qc ALG
  2⤵
  PID:5716
- C:\Windows\system32\sc.exe
  "sc" qc AppIDSvc
  2⤵
  PID:3984
- C:\Windows\system32\sc.exe
  "sc" qc Appinfo
  2⤵
  - Launches sc.exe
  PID:3764
- C:\Windows\system32\sc.exe
  "sc" qc AppMgmt
  2⤵
  - Launches sc.exe
  PID:5600
- C:\Windows\system32\sc.exe
  "sc" qc AppReadiness
  2⤵
  PID:2336
- C:\Windows\system32\sc.exe
  "sc" qc AppVClient
  2⤵
  PID:2852
- C:\Windows\system32\sc.exe
  "sc" qc AppXSvc
  2⤵
  PID:5968
- C:\Windows\system32\sc.exe
  "sc" qc AssignedAccessManagerSvc
  2⤵
  - Launches sc.exe
  PID:5964
- C:\Windows\system32\sc.exe
  "sc" qc AudioEndpointBuilder
  2⤵
  PID:4940
- C:\Windows\system32\sc.exe
  "sc" qc Audiosrv
  2⤵
  PID:1052
- C:\Windows\system32\sc.exe
  "sc" qc autotimesvc
  2⤵
  PID:2100
- C:\Windows\system32\sc.exe
  "sc" qc AxInstSV
  2⤵
  PID:1416
- C:\Windows\system32\sc.exe
  "sc" qc BDESVC
  2⤵
  PID:5632
- C:\Windows\system32\sc.exe
  "sc" qc BFE
  2⤵
  PID:4572
- C:\Windows\system32\sc.exe
  "sc" qc BITS
  2⤵
  PID:1464
- C:\Windows\system32\sc.exe
  "sc" qc BrokerInfrastructure
  2⤵
  PID:3816
- C:\Windows\system32\sc.exe
  "sc" qc BTAGService
  2⤵
  PID:4088
- C:\Windows\system32\sc.exe
  "sc" qc BthAvctpSvc
  2⤵
  PID:4560
- C:\Windows\system32\sc.exe
  "sc" qc bthserv
  2⤵
  PID:3416
- C:\Windows\system32\sc.exe
  "sc" qc camsvc
  2⤵
  PID:1048
- C:\Windows\system32\sc.exe
  "sc" qc CDPSvc
  2⤵
  - Launches sc.exe
  PID:4016
- C:\Windows\system32\sc.exe
  "sc" qc CertPropSvc
  2⤵
  PID:5604
- C:\Windows\system32\sc.exe
  "sc" qc ClickToRunSvc
  2⤵
  PID:5580
- C:\Windows\system32\sc.exe
  "sc" qc ClipSVC
  2⤵
  PID:5824
- C:\Windows\system32\sc.exe
  "sc" qc COMSysApp
  2⤵
  - Launches sc.exe
  PID:2152
- C:\Windows\system32\sc.exe
  "sc" qc CoreMessagingRegistrar
  2⤵
  PID:5256
- C:\Windows\system32\sc.exe
  "sc" qc CryptSvc
  2⤵
  PID:3524
- C:\Windows\system32\sc.exe
  "sc" qc CscService
  2⤵
  - Launches sc.exe
  PID:760
- C:\Windows\system32\sc.exe
  "sc" qc DcomLaunch
  2⤵
  - Launches sc.exe
  PID:624
- C:\Windows\system32\sc.exe
  "sc" qc defragsvc
  2⤵
  PID:5644
- C:\Windows\system32\sc.exe
  "sc" qc DeviceAssociationService
  2⤵
  - Launches sc.exe
  PID:1940
- C:\Windows\system32\sc.exe
  "sc" qc DeviceInstall
  2⤵
  PID:1140
- C:\Windows\system32\sc.exe
  "sc" qc DevQueryBroker
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\sc.exe
  "sc" qc Dhcp
  2⤵
  - Launches sc.exe
  PID:4848
- C:\Windows\system32\sc.exe
  "sc" qc diagnosticshub.standardcollector.service
  2⤵
  PID:5060
- C:\Windows\system32\sc.exe
  "sc" qc diagsvc
  2⤵
  - Launches sc.exe
  PID:4640
- C:\Windows\system32\sc.exe
  "sc" qc DiagTrack
  2⤵
  - Launches sc.exe
  PID:4676
- C:\Windows\system32\sc.exe
  "sc" qc DialogBlockingService
  2⤵
  - Launches sc.exe
  PID:4168
- C:\Windows\system32\sc.exe
  "sc" qc DispBrokerDesktopSvc
  2⤵
  - Launches sc.exe
  PID:1520
- C:\Windows\system32\sc.exe
  "sc" qc DisplayEnhancementService
  2⤵
  PID:5408
- C:\Windows\system32\sc.exe
  "sc" qc DmEnrollmentSvc
  2⤵
  PID:5612
- C:\Windows\system32\sc.exe
  "sc" qc dmwappushservice
  2⤵
  PID:5940
- C:\Windows\system32\sc.exe
  "sc" qc Dnscache
  2⤵
  PID:5428
- C:\Windows\system32\sc.exe
  "sc" qc DoSvc
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\system32\sc.exe
  "sc" qc dot3svc
  2⤵
  PID:3588
- C:\Windows\system32\sc.exe
  "sc" qc DPS
  2⤵
  PID:3268
- C:\Windows\system32\sc.exe
  "sc" qc DsmSvc
  2⤵
  PID:5740
- C:\Windows\system32\sc.exe
  "sc" qc DsSvc
  2⤵
  - Launches sc.exe
  PID:4316
- C:\Windows\system32\sc.exe
  "sc" qc DusmSvc
  2⤵
  PID:1616
- C:\Windows\system32\sc.exe
  "sc" qc Eaphost
  2⤵
  PID:6004
- C:\Windows\system32\sc.exe
  "sc" qc edgeupdate
  2⤵
  PID:1772
- C:\Windows\system32\sc.exe
  "sc" qc edgeupdatem
  2⤵
  PID:2544
- C:\Windows\system32\sc.exe
  "sc" qc EFS
  2⤵
  PID:4392
- C:\Windows\system32\sc.exe
  "sc" qc embeddedmode
  2⤵
  - Launches sc.exe
  PID:5320
- C:\Windows\system32\sc.exe
  "sc" qc EntAppSvc
  2⤵
  PID:1640
- C:\Windows\system32\sc.exe
  "sc" qc EventLog
  2⤵
  PID:1856
- C:\Windows\system32\sc.exe
  "sc" qc EventSystem
  2⤵
  PID:5412
- C:\Windows\system32\sc.exe
  "sc" qc Fax
  2⤵
  PID:6044
- C:\Windows\system32\sc.exe
  "sc" qc fdPHost
  2⤵
  PID:4964
- C:\Windows\system32\sc.exe
  "sc" qc FDResPub
  2⤵
  PID:4420
- C:\Windows\system32\sc.exe
  "sc" qc fhsvc
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  "sc" qc FontCache
  2⤵
  PID:4652
- C:\Windows\system32\sc.exe
  "sc" qc FontCache3.0.0.0
  2⤵
  PID:1064
- C:\Windows\system32\sc.exe
  "sc" qc FrameServer
  2⤵
  PID:1028
- C:\Windows\system32\sc.exe
  "sc" qc GoogleChromeElevationService
  2⤵
  PID:5700
- C:\Windows\system32\sc.exe
  "sc" qc GoogleUpdaterInternalService141.0.7340.0
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  "sc" qc GoogleUpdaterService141.0.7340.0
  2⤵
  PID:3992
- C:\Windows\system32\sc.exe
  "sc" qc gpsvc
  2⤵
  - Launches sc.exe
  PID:3824
- C:\Windows\system32\sc.exe
  "sc" qc GraphicsPerfSvc
  2⤵
  PID:1548
- C:\Windows\system32\sc.exe
  "sc" qc hidserv
  2⤵
  PID:5816
- C:\Windows\system32\sc.exe
  "sc" qc HvHost
  2⤵
  - Launches sc.exe
  PID:5932
- C:\Windows\system32\sc.exe
  "sc" qc icssvc
  2⤵
  - Launches sc.exe
  PID:1376
- C:\Windows\system32\sc.exe
  "sc" qc IKEEXT
  2⤵
  PID:5748
- C:\Windows\system32\sc.exe
  "sc" qc InstallService
  2⤵
  PID:2160
- C:\Windows\system32\sc.exe
  "sc" qc iphlpsvc
  2⤵
  PID:4664
- C:\Windows\system32\sc.exe
  "sc" qc IpxlatCfgSvc
  2⤵
  PID:3864
- C:\Windows\system32\sc.exe
  "sc" qc KeyIso
  2⤵
  PID:5668
- C:\Windows\system32\sc.exe
  "sc" qc KtmRm
  2⤵
  PID:3196
- C:\Windows\system32\sc.exe
  "sc" qc LanmanServer
  2⤵
  PID:60
- C:\Windows\system32\sc.exe
  "sc" qc LanmanWorkstation
  2⤵
  PID:2052
- C:\Windows\system32\sc.exe
  "sc" qc lfsvc
  2⤵
  PID:5308
- C:\Windows\system32\sc.exe
  "sc" qc LicenseManager
  2⤵
  PID:1088
- C:\Windows\system32\sc.exe
  "sc" qc lltdsvc
  2⤵
  PID:4028
- C:\Windows\system32\sc.exe
  "sc" qc lmhosts
  2⤵
  PID:3408
- C:\Windows\system32\sc.exe
  "sc" qc LSM
  2⤵
  PID:2056
- C:\Windows\system32\sc.exe
  "sc" qc LxpSvc
  2⤵
  PID:4956
- C:\Windows\system32\sc.exe
  "sc" qc MapsBroker
  2⤵
  PID:4552
- C:\Windows\system32\sc.exe
  "sc" qc MicrosoftEdgeElevationService
  2⤵
  - Launches sc.exe
  PID:3568
- C:\Windows\system32\sc.exe
  "sc" qc MixedRealityOpenXRSvc
  2⤵
  PID:6080
- C:\Windows\system32\sc.exe
  "sc" qc MozillaMaintenance
  2⤵
  PID:5136
- C:\Windows\system32\sc.exe
  "sc" qc mpssvc
  2⤵
  PID:5272
- C:\Windows\system32\sc.exe
  "sc" qc MSDTC
  2⤵
  PID:5336
- C:\Windows\system32\sc.exe
  "sc" qc MSiSCSI
  2⤵
  PID:1592
- C:\Windows\system32\sc.exe
  "sc" qc msiserver
  2⤵
  PID:5568
- C:\Windows\system32\sc.exe
  "sc" qc MsKeyboardFilter
  2⤵
  PID:5332
- C:\Windows\system32\sc.exe
  "sc" qc NaturalAuthentication
  2⤵
  PID:1304
- C:\Windows\system32\sc.exe
  "sc" qc NcaSvc
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\sc.exe
  "sc" qc NcbService
  2⤵
  PID:5156
- C:\Windows\system32\sc.exe
  "sc" qc NcdAutoSetup
  2⤵
  PID:4168
- C:\Windows\system32\sc.exe
  "sc" qc Netlogon
  2⤵
  PID:3856
- C:\Windows\system32\sc.exe
  "sc" qc Netman
  2⤵
  PID:824
- C:\Windows\system32\sc.exe
  "sc" qc netprofm
  2⤵
  PID:1496
- C:\Windows\system32\sc.exe
  "sc" qc NetSetupSvc
  2⤵
  PID:1096
- C:\Windows\system32\sc.exe
  "sc" qc NetTcpPortSharing
  2⤵
  - Launches sc.exe
  PID:220
- C:\Windows\system32\sc.exe
  "sc" qc NgcCtnrSvc
  2⤵
  PID:4596
- C:\Windows\system32\sc.exe
  "sc" qc NgcSvc
  2⤵
  PID:3588
- C:\Windows\system32\sc.exe
  "sc" qc NlaSvc
  2⤵
  PID:3268
- C:\Windows\system32\sc.exe
  "sc" qc nsi
  2⤵
  - Launches sc.exe
  PID:3476
- C:\Windows\system32\sc.exe
  "sc" qc ose64
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  "sc" qc p2pimsvc
  2⤵
  - Launches sc.exe
  PID:1884
- C:\Windows\system32\sc.exe
  "sc" qc p2psvc
  2⤵
  PID:4548
- C:\Windows\system32\sc.exe
  "sc" qc PcaSvc
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  "sc" qc PeerDistSvc
  2⤵
  PID:6012
- C:\Windows\system32\sc.exe
  "sc" qc perceptionsimulation
  2⤵
  PID:5804
- C:\Windows\system32\sc.exe
  "sc" qc PerfHost
  2⤵
  - Launches sc.exe
  PID:5196
- C:\Windows\system32\sc.exe
  "sc" qc PhoneSvc
  2⤵
  - Launches sc.exe
  PID:440
- C:\Windows\system32\sc.exe
  "sc" qc pla
  2⤵
  PID:3932
- C:\Windows\system32\sc.exe
  "sc" qc PlugPlay
  2⤵
  PID:4756
- C:\Windows\system32\sc.exe
  "sc" qc PNRPAutoReg
  2⤵
  PID:5232
- C:\Windows\system32\sc.exe
  "sc" qc PNRPsvc
  2⤵
  PID:1580
- C:\Windows\system32\sc.exe
  "sc" qc PolicyAgent
  2⤵
  PID:5524
- C:\Windows\system32\sc.exe
  "sc" qc Power
  2⤵
  PID:4692
- C:\Windows\system32\sc.exe
  "sc" qc PrintNotify
  2⤵
  - Launches sc.exe
  PID:856
- C:\Windows\system32\sc.exe
  "sc" qc ProfSvc
  2⤵
  PID:2268
- C:\Windows\system32\sc.exe
  "sc" qc PushToInstall
  2⤵
  PID:1100
- C:\Windows\system32\sc.exe
  "sc" qc QWAVE
  2⤵
  - Launches sc.exe
  PID:4304
- C:\Windows\system32\sc.exe
  "sc" qc RasAuto
  2⤵
  PID:3224
- C:\Windows\system32\sc.exe
  "sc" qc RasMan
  2⤵
  PID:2732
- C:\Windows\system32\sc.exe
  "sc" qc RemoteAccess
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  "sc" qc RemoteRegistry
  2⤵
  - Launches sc.exe
  PID:2812
- C:\Windows\system32\sc.exe
  "sc" qc RetailDemo
  2⤵
  PID:4180
- C:\Windows\system32\sc.exe
  "sc" qc RmSvc
  2⤵
  PID:5964
- C:\Windows\system32\sc.exe
  "sc" qc RpcEptMapper
  2⤵
  PID:3084
- C:\Windows\system32\sc.exe
  "sc" qc RpcLocator
  2⤵
  PID:1060
- C:\Windows\system32\sc.exe
  "sc" qc RpcSs
  2⤵
  PID:1360
- C:\Windows\system32\sc.exe
  "sc" qc SamSs
  2⤵
  PID:3340
- C:\Windows\system32\sc.exe
  "sc" qc SCardSvr
  2⤵
  PID:5792
- C:\Windows\system32\sc.exe
  "sc" qc ScDeviceEnum
  2⤵
  PID:5720
- C:\Windows\system32\sc.exe
  "sc" qc Schedule
  2⤵
  PID:5788
- C:\Windows\system32\sc.exe
  "sc" qc SCPolicySvc
  2⤵
  PID:4088
- C:\Windows\system32\sc.exe
  "sc" qc SDRSVC
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  "sc" qc seclogon
  2⤵
  PID:1088
- C:\Windows\system32\sc.exe
  "sc" qc SEMgrSvc
  2⤵
  PID:4028
- C:\Windows\system32\sc.exe
  "sc" qc SENS
  2⤵
  - Launches sc.exe
  PID:3332
- C:\Windows\system32\sc.exe
  "sc" qc SensorDataService
  2⤵
  PID:4472
- C:\Windows\system32\sc.exe
  "sc" qc SensorService
  2⤵
  PID:3188
- C:\Windows\system32\sc.exe
  "sc" qc SensrSvc
  2⤵
  - Launches sc.exe
  PID:5824
- C:\Windows\system32\sc.exe
  "sc" qc SessionEnv
  2⤵
  PID:5216
- C:\Windows\system32\sc.exe
  "sc" qc SgrmBroker
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  "sc" qc SharedAccess
  2⤵
  PID:3492
- C:\Windows\system32\sc.exe
  "sc" qc SharedRealitySvc
  2⤵
  PID:5228
- C:\Windows\system32\sc.exe
  "sc" qc ShellHWDetection
  2⤵
  PID:4188
- C:\Windows\system32\sc.exe
  "sc" qc shpamsvc
  2⤵
  - Launches sc.exe
  PID:4372
- C:\Windows\system32\sc.exe
  "sc" qc smphost
  2⤵
  PID:1988
- C:\Windows\system32\sc.exe
  "sc" qc SmsRouter
  2⤵
  PID:5652
- C:\Windows\system32\sc.exe
  "sc" qc SNMPTRAP
  2⤵
  PID:1604
- C:\Windows\system32\sc.exe
  "sc" qc spectrum
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  "sc" qc Spooler
  2⤵
  - Launches sc.exe
  PID:4168
- C:\Windows\system32\sc.exe
  "sc" qc sppsvc
  2⤵
  PID:1628
- C:\Windows\system32\sc.exe
  "sc" qc SSDPSRV
  2⤵
  - Launches sc.exe
  PID:5508
- C:\Windows\system32\sc.exe
  "sc" qc ssh-agent
  2⤵
  PID:1732
- C:\Windows\system32\sc.exe
  "sc" qc SstpSvc
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\system32\sc.exe
  "sc" qc StateRepository
  2⤵
  PID:3236
- C:\Windows\system32\sc.exe
  "sc" qc stisvc
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  "sc" qc StorSvc
  2⤵
  PID:5204
- C:\Windows\system32\sc.exe
  "sc" qc svsvc
  2⤵
  PID:4312
- C:\Windows\system32\sc.exe
  "sc" qc swprv
  2⤵
  - Launches sc.exe
  PID:3076
- C:\Windows\system32\sc.exe
  "sc" qc SysMain
  2⤵
  PID:5068
- C:\Windows\system32\sc.exe
  "sc" qc SystemEventsBroker
  2⤵
  PID:4196
- C:\Windows\system32\sc.exe
  "sc" qc TabletInputService
  2⤵
  - Launches sc.exe
  PID:1772
- C:\Windows\system32\sc.exe
  "sc" qc TapiSrv
  2⤵
  PID:2644
- C:\Windows\system32\sc.exe
  "sc" qc TermService
  2⤵
  - Launches sc.exe
  PID:4104
- C:\Windows\system32\sc.exe
  "sc" qc Themes
  2⤵
  PID:5876
- C:\Windows\system32\sc.exe
  "sc" qc TieringEngineService
  2⤵
  PID:1904
- C:\Windows\system32\sc.exe
  "sc" qc TimeBrokerSvc
  2⤵
  PID:1856
- C:\Windows\system32\sc.exe
  "sc" qc TokenBroker
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\system32\sc.exe
  "sc" qc TrkWks
  2⤵
  PID:5464
- C:\Windows\system32\sc.exe
  "sc" qc TroubleshootingSvc
  2⤵
  PID:3024
- C:\Windows\system32\sc.exe
  "sc" qc TrustedInstaller
  2⤵
  PID:1840
- C:\Windows\system32\sc.exe
  "sc" qc tzautoupdate
  2⤵
  PID:956
- C:\Windows\system32\sc.exe
  "sc" qc UevAgentService
  2⤵
  - Launches sc.exe
  PID:472
- C:\Windows\system32\sc.exe
  "sc" qc UmRdpService
  2⤵
  PID:5440
- C:\Windows\system32\sc.exe
  "sc" qc upnphost
  2⤵
  - Launches sc.exe
  PID:992
- C:\Windows\system32\sc.exe
  "sc" qc UserManager
  2⤵
  PID:3984
- C:\Windows\system32\sc.exe
  "sc" qc UsoSvc
  2⤵
  PID:3764
- C:\Windows\system32\sc.exe
  "sc" qc VacSvc
  2⤵
  PID:5048
- C:\Windows\system32\sc.exe
  "sc" qc VaultSvc
  2⤵
  PID:3768
- C:\Windows\system32\sc.exe
  "sc" qc vds
  2⤵
  PID:4108
- C:\Windows\system32\sc.exe
  "sc" qc vmicguestinterface
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  "sc" qc vmicheartbeat
  2⤵
  PID:4648
- C:\Windows\system32\sc.exe
  "sc" qc vmickvpexchange
  2⤵
  - Launches sc.exe
  PID:3084
- C:\Windows\system32\sc.exe
  "sc" qc vmicrdv
  2⤵
  - Launches sc.exe
  PID:1060
- C:\Windows\system32\sc.exe
  "sc" qc vmicshutdown
  2⤵
  PID:4664
- C:\Windows\system32\sc.exe
  "sc" qc vmictimesync
  2⤵
  - Launches sc.exe
  PID:5360
- C:\Windows\system32\sc.exe
  "sc" qc vmicvmsession
  2⤵
  PID:5116
- C:\Windows\system32\sc.exe
  "sc" qc vmicvss
  2⤵
  PID:5912
- C:\Windows\system32\sc.exe
  "sc" qc VSS
  2⤵
  PID:2788
- C:\Windows\system32\sc.exe
  "sc" qc WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4000
- C:\Windows\system32\sc.exe
  "sc" qc WalletService
  2⤵
  PID:3184
- C:\Windows\system32\sc.exe
  "sc" qc WarpJITSvc
  2⤵
  - Launches sc.exe
  PID:5172
- C:\Windows\system32\sc.exe
  "sc" qc wbengine
  2⤵
  PID:2744
- C:\Windows\system32\sc.exe
  "sc" qc WbioSrvc
  2⤵
  PID:2596
- C:\Windows\system32\sc.exe
  "sc" qc Wcmsvc
  2⤵
  - Launches sc.exe
  PID:4476
- C:\Windows\system32\sc.exe
  "sc" qc wcncsvc
  2⤵
  PID:1216
- C:\Windows\system32\sc.exe
  "sc" qc WdiServiceHost
  2⤵
  PID:2736
- C:\Windows\system32\sc.exe
  "sc" qc WdiSystemHost
  2⤵
  PID:4668
- C:\Windows\system32\sc.exe
  "sc" qc WebClient
  2⤵
  PID:5236
- C:\Windows\system32\sc.exe
  "sc" qc Wecsvc
  2⤵
  - Launches sc.exe
  PID:5336
- C:\Windows\system32\sc.exe
  "sc" qc WEPHOSTSVC
  2⤵
  PID:1576
- C:\Windows\system32\sc.exe
  "sc" qc wercplsupport
  2⤵
  PID:5820
- C:\Windows\system32\sc.exe
  "sc" qc WerSvc
  2⤵
  PID:5980
- C:\Windows\system32\sc.exe
  "sc" qc WFDSConMgrSvc
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\system32\sc.exe
  "sc" qc WiaRpc
  2⤵
  - Launches sc.exe
  PID:6068
- C:\Windows\system32\sc.exe
  "sc" qc WinHttpAutoProxySvc
  2⤵
  PID:5156
- C:\Windows\system32\sc.exe
  "sc" qc Winmgmt
  2⤵
  - Launches sc.exe
  PID:1588
- C:\Windows\system32\sc.exe
  "sc" qc WinRM
  2⤵
  PID:5128
- C:\Windows\system32\sc.exe
  "sc" qc wisvc
  2⤵
  PID:2096
- C:\Windows\system32\sc.exe
  "sc" qc WlanSvc
  2⤵
  PID:452
- C:\Windows\system32\sc.exe
  "sc" qc wlidsvc
  2⤵
  PID:2528
- C:\Windows\system32\sc.exe
  "sc" qc wlpasvc
  2⤵
  PID:1116
- C:\Windows\system32\sc.exe
  "sc" qc WManSvc
  2⤵
  PID:5416
- C:\Windows\system32\sc.exe
  "sc" qc wmiApSrv
  2⤵
  - Launches sc.exe
  PID:4428
- C:\Windows\system32\sc.exe
  "sc" qc WMPNetworkSvc
  2⤵
  - Launches sc.exe
  PID:4284
- C:\Windows\system32\sc.exe
  "sc" qc workfolderssvc
  2⤵
  - Launches sc.exe
  PID:3384
- C:\Windows\system32\sc.exe
  "sc" qc WpcMonSvc
  2⤵
  PID:2488
- C:\Windows\system32\sc.exe
  "sc" qc WPDBusEnum
  2⤵
  PID:4224
- C:\Windows\system32\sc.exe
  "sc" qc WpnService
  2⤵
  PID:4896
- C:\Windows\system32\sc.exe
  "sc" qc wscsvc
  2⤵
  - Launches sc.exe
  PID:5344
- C:\Windows\system32\sc.exe
  "sc" qc WSearch
  2⤵
  - Launches sc.exe
  PID:5196
- C:\Windows\system32\sc.exe
  "sc" qc wuauserv
  2⤵
  PID:5432
- C:\Windows\system32\sc.exe
  "sc" qc WwanSvc
  2⤵
  PID:4832
- C:\Windows\system32\sc.exe
  "sc" qc XblAuthManager
  2⤵
  PID:1856
- C:\Windows\system32\sc.exe
  "sc" qc XblGameSave
  2⤵
  PID:5412
- C:\Windows\system32\sc.exe
  "sc" qc XboxGipSvc
  2⤵
  PID:4964
- C:\Windows\system32\sc.exe
  "sc" qc XboxNetApiSvc
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  "sc" qc AarSvc_2467a
  2⤵
  PID:2624
- C:\Windows\system32\sc.exe
  "sc" qc BcastDVRUserService_2467a
  2⤵
  PID:3712
- C:\Windows\system32\sc.exe
  "sc" qc BluetoothUserService_2467a
  2⤵
  PID:3536
- C:\Windows\system32\sc.exe
  "sc" qc CaptureService_2467a
  2⤵
  - Launches sc.exe
  PID:3160
- C:\Windows\system32\sc.exe
  "sc" qc cbdhsvc_2467a
  2⤵
  - Launches sc.exe
  PID:1028
- C:\Windows\system32\sc.exe
  "sc" qc CDPUserSvc_2467a
  2⤵
  PID:5676
- C:\Windows\system32\sc.exe
  "sc" qc ConsentUxUserSvc_2467a
  2⤵
  PID:2916
- C:\Windows\system32\sc.exe
  "sc" qc CredentialEnrollmentManagerUserSvc_2467a
  2⤵
  PID:3824
- C:\Windows\system32\sc.exe
  "sc" qc DeviceAssociationBrokerSvc_2467a
  2⤵
  PID:5948
- C:\Windows\system32\sc.exe
  "sc" qc DevicePickerUserSvc_2467a
  2⤵
  PID:4180
- C:\Windows\system32\sc.exe
  "sc" qc DevicesFlowUserSvc_2467a
  2⤵
  - Launches sc.exe
  PID:4940
- C:\Windows\system32\sc.exe
  "sc" qc MessagingService_2467a
  2⤵
  - Launches sc.exe
  PID:5964
- C:\Windows\system32\sc.exe
  "sc" qc OneSyncSvc_2467a
  2⤵
  - Launches sc.exe
  PID:3080
- C:\Windows\system32\sc.exe
  "sc" qc PimIndexMaintenanceSvc_2467a
  2⤵
  - Launches sc.exe
  PID:3428
- C:\Windows\system32\sc.exe
  "sc" qc PrintWorkflowUserSvc_2467a
  2⤵
  PID:1360
- C:\Windows\system32\sc.exe
  "sc" qc UdkUserSvc_2467a
  2⤵
  PID:3048
- C:\Windows\system32\sc.exe
  "sc" qc UnistoreSvc_2467a
  2⤵
  PID:3256
- C:\Windows\system32\sc.exe
  "sc" qc UserDataSvc_2467a
  2⤵
  PID:1168
- C:\Windows\system32\sc.exe
  "sc" qc WpnUserService_2467a
  2⤵
  PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /c "wmic process where \"ExecutablePath like '%C:\\ProgramData%Microsoft%'\" get ProcessId /format:csv 2>nul"
  2⤵
  PID:4028
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where \"ExecutablePath like '%C:\\ProgramData%Microsoft%'\" get ProcessId /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsTelemetry /f
  2⤵
  - Modifies registry key
  PID:6036
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftTelemetry /f
  2⤵
  - Modifies registry key
  PID:3568
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemTelemetry /f
  2⤵
  - Modifies registry key
  PID:4912
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinTelemetry /f
  2⤵
  - Modifies registry key
  PID:64
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetTelemetry /f
  2⤵
  - Modifies registry key
  PID:4668
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthCheck /f
  2⤵
  - Modifies registry key
  PID:5236
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftHealthCheck /f
  2⤵
  - Modifies registry key
  PID:4836
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemHealthCheck /f
  2⤵
  - Modifies registry key
  PID:3592
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinHealthCheck /f
  2⤵
  - Modifies registry key
  PID:1988
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetHealthCheck /f
  2⤵
  - Modifies registry key
  PID:4520
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsNetProfile /f
  2⤵
  - Modifies registry key
  PID:5868
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftNetProfile /f
  2⤵
  - Modifies registry key
  PID:4688
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemNetProfile /f
  2⤵
  - Modifies registry key
  PID:2428
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinNetProfile /f
  2⤵
  - Modifies registry key
  PID:4216
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetNetProfile /f
  2⤵
  - Modifies registry key
  PID:4360
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDiagTrack /f
  2⤵
  - Modifies registry key
  PID:1096
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDiagTrack /f
  2⤵
  - Modifies registry key
  PID:216
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemDiagTrack /f
  2⤵
  - Modifies registry key
  PID:5212
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDiagTrack /f
  2⤵
  - Modifies registry key
  PID:4408
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetDiagTrack /f
  2⤵
  - Modifies registry key
  PID:5588
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAppVerifier /f
  2⤵
  - Modifies registry key
  PID:5740
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftAppVerifier /f
  2⤵
  - Modifies registry key
  PID:4316
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemAppVerifier /f
  2⤵
  - Modifies registry key
  PID:5552
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinAppVerifier /f
  2⤵
  - Modifies registry key
  PID:4292
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetAppVerifier /f
  2⤵
  - Modifies registry key
  PID:5364
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:4232
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:5312
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:4916
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:4608
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:5648
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsCompatCache /f
  2⤵
  - Modifies registry key
  PID:1652
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftCompatCache /f
  2⤵
  - Modifies registry key
  PID:2560
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemCompatCache /f
  2⤵
  - Modifies registry key
  PID:4964
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinCompatCache /f
  2⤵
  - Modifies registry key
  PID:4852
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetCompatCache /f
  2⤵
  - Modifies registry key
  PID:1004
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsTokenBroker /f
  2⤵
  - Modifies registry key
  PID:1064
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftTokenBroker /f
  2⤵
  - Modifies registry key
  PID:3412
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemTokenBroker /f
  2⤵
  - Modifies registry key
  PID:5724
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinTokenBroker /f
  2⤵
  - Modifies registry key
  PID:1980
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetTokenBroker /f
  2⤵
  - Modifies registry key
  PID:5636
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:2572
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:5808
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:5932
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:3364
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:4348
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:4588
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:2308
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:1488
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:2416
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:3340
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792} /f
  2⤵
  - Modifies registry key
  PID:2116
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ EnhancedStorageShell" /f
  2⤵
  PID:884
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /TN \Microsoft\Windows\AppTask\SyncHost-{05A7B-E0190-482BF-A7C1} /F
  2⤵
  PID:8
- C:\Windows\System32\Wbem\mofcomp.exe
  "mofcomp.exe" C:\Users\Admin\AppData\Local\Temp\_cl.mof
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Users\Admin\AppData\Local\SysCache\smss64.exe
  "C:\Users\Admin\AppData\Local\SysCache\smss64.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender notification settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'smss64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'NetTokenSvc.exe' -ErrorAction SilentlyContinue" >nul 2>&1
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'smss64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'NetTokenSvc.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetPerformanceLog' -ErrorAction SilentlyContinue" >nul 2>&1
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetPerformanceLog' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5296
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\SysCache\smss64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4164

C:\Users\Admin\AppData\Local\SysCache\smss64.exe
C:\Users\Admin\AppData\Local\SysCache\smss64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4188

C:\ProgramData\Microsoft\NetPerformanceLog\smss64.exe
C:\ProgramData\Microsoft\NetPerformanceLog\smss64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

T1082

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion