havoc | 14df73f68eaf92accabcc339366e94a4384f7cb26348f37c212a9f50f5bba76a

Resubmissions

28/07/2026, 06:21

260728-g4krfacn7w10

28/07/2026, 06:19

260728-g3ffbszejf10

Analysis

user interaction
yes
max time kernel
34s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OGFN Ext by Fr4nky.exe
Size 160KB
Sample260728-g3ffbszejf
SHA256 14df73f68eaf92accabcc339366e94a4384f7cb26348f37c212a9f50f5bba76a
MD5 ea6464d6d81a30767f65c47b73f5b988
SHA1 f38587fec68976581efe64d4b554d515039e562c
SHA512 6756158769178ce39ebfb1039200bac7a75f0d1d54dbdc9f91609a905dea705151af4f12aab5a48c12f2bebd1ffeac4b7708a97ec8632ebbc4a643fa95556bd4
SSDEEP 3072:eaZxxKy1vCdAOa5ORinNfIgLQr0IkMipDZnuIUz:pLn1vCdAOaKinNQrpeln5Uz
TLSH
T1C8F30703D56720FEC1A9C6B4878BA632FA73B45C17746A8F1710CEA51F61AB0B73D606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion execution havoc persistence trojan

Malware Config

Signatures

Family: Havoc, HavocC2
Havoc is an open-source backdoor and post-exploitation framework written in C++.
backdoor havoc

Detects Havoc payload 2 IoCs

resource	yara_rule
behavioral2/memory/2996-190-0x0000025C2E730000-0x0000025C2E74A000-memory.dmp	family_havoc
behavioral2/files/0x001e000000000441-199.dat	family_havoc

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	OGFN Ext by Fr4nky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	OGFN Ext by Fr4nky.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5856	powershell.exe
4756	powershell.exe
1444	powershell.exe
4884	powershell.exe
4356	powershell.exe
596	powershell.exe
1864	powershell.exe
1828	powershell.exe
5556	powershell.exe
4264	powershell.exe
4860	powershell.exe
1852	powershell.exe
2144	powershell.exe
1360	powershell.exe
5128	powershell.exe
2616	powershell.exe
2976	powershell.exe
992	powershell.exe
6096	powershell.exe
3308	powershell.exe
3788	powershell.exe
3724	powershell.exe
5944	powershell.exe
5984	powershell.exe
1848	powershell.exe
5456	powershell.exe
4856	powershell.exe
2828	powershell.exe
3580	powershell.exe
3396	powershell.exe
4832	powershell.exe
3428	powershell.exe
1420	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
52	MicrosoftEdgeUpdate1.exe
256	MicrosoftEdgeUpdate1.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	OGFN Ext by Fr4nky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	OGFN Ext by Fr4nky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	OGFN Ext by Fr4nky.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate1 = "\"C:\\ProgramData\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate1.exe\" --no-startup-window --win-session-start"	OGFN Ext by Fr4nky.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
2144	powershell.exe
2144	powershell.exe
2144	powershell.exe
3396	powershell.exe
3396	powershell.exe
3396	powershell.exe
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
1828	powershell.exe
1828	powershell.exe
1828	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
992	powershell.exe
992	powershell.exe
992	powershell.exe
3788	powershell.exe
3788	powershell.exe
3788	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
1848	powershell.exe
1848	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
1848	powershell.exe
6096	powershell.exe
5128	powershell.exe
6096	powershell.exe
5128	powershell.exe
5128	powershell.exe
6096	powershell.exe
5456	powershell.exe
5456	powershell.exe
5456	powershell.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeIncreaseQuotaPrivilege	4856	powershell.exe
Token: SeSecurityPrivilege	4856	powershell.exe
Token: SeTakeOwnershipPrivilege	4856	powershell.exe
Token: SeLoadDriverPrivilege	4856	powershell.exe
Token: SeSystemProfilePrivilege	4856	powershell.exe
Token: SeSystemtimePrivilege	4856	powershell.exe
Token: SeProfSingleProcessPrivilege	4856	powershell.exe
Token: SeIncBasePriorityPrivilege	4856	powershell.exe
Token: SeCreatePagefilePrivilege	4856	powershell.exe
Token: SeBackupPrivilege	4856	powershell.exe
Token: SeRestorePrivilege	4856	powershell.exe
Token: SeShutdownPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeSystemEnvironmentPrivilege	4856	powershell.exe
Token: SeRemoteShutdownPrivilege	4856	powershell.exe
Token: SeUndockPrivilege	4856	powershell.exe
Token: SeManageVolumePrivilege	4856	powershell.exe
Token: 33	4856	powershell.exe
Token: 34	4856	powershell.exe
Token: 35	4856	powershell.exe
Token: 36	4856	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeIncreaseQuotaPrivilege	2144	powershell.exe
Token: SeSecurityPrivilege	2144	powershell.exe
Token: SeTakeOwnershipPrivilege	2144	powershell.exe
Token: SeLoadDriverPrivilege	2144	powershell.exe
Token: SeSystemProfilePrivilege	2144	powershell.exe
Token: SeSystemtimePrivilege	2144	powershell.exe
Token: SeProfSingleProcessPrivilege	2144	powershell.exe
Token: SeIncBasePriorityPrivilege	2144	powershell.exe
Token: SeCreatePagefilePrivilege	2144	powershell.exe
Token: SeBackupPrivilege	2144	powershell.exe
Token: SeRestorePrivilege	2144	powershell.exe
Token: SeShutdownPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeSystemEnvironmentPrivilege	2144	powershell.exe
Token: SeRemoteShutdownPrivilege	2144	powershell.exe
Token: SeUndockPrivilege	2144	powershell.exe
Token: SeManageVolumePrivilege	2144	powershell.exe
Token: 33	2144	powershell.exe
Token: 34	2144	powershell.exe
Token: 35	2144	powershell.exe
Token: 36	2144	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	powershell.exe
Token: SeSecurityPrivilege	3396	powershell.exe
Token: SeTakeOwnershipPrivilege	3396	powershell.exe
Token: SeLoadDriverPrivilege	3396	powershell.exe
Token: SeSystemProfilePrivilege	3396	powershell.exe
Token: SeSystemtimePrivilege	3396	powershell.exe
Token: SeProfSingleProcessPrivilege	3396	powershell.exe
Token: SeIncBasePriorityPrivilege	3396	powershell.exe
Token: SeCreatePagefilePrivilege	3396	powershell.exe
Token: SeBackupPrivilege	3396	powershell.exe
Token: SeRestorePrivilege	3396	powershell.exe
Token: SeShutdownPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeSystemEnvironmentPrivilege	3396	powershell.exe
Token: SeRemoteShutdownPrivilege	3396	powershell.exe
Token: SeUndockPrivilege	3396	powershell.exe
Token: SeManageVolumePrivilege	3396	powershell.exe
Token: 33	3396	powershell.exe
Token: 34	3396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4848	2996	OGFN Ext by Fr4nky.exe	90
PID 2996 wrote to memory of 4856	2996	OGFN Ext by Fr4nky.exe	92
PID 2996 wrote to memory of 4676	2996	OGFN Ext by Fr4nky.exe	95
PID 2996 wrote to memory of 2988	2996	OGFN Ext by Fr4nky.exe	97
PID 2996 wrote to memory of 5800	2996	OGFN Ext by Fr4nky.exe	99
PID 2996 wrote to memory of 4580	2996	OGFN Ext by Fr4nky.exe	101
PID 2996 wrote to memory of 1800	2996	OGFN Ext by Fr4nky.exe	103
PID 2996 wrote to memory of 1028	2996	OGFN Ext by Fr4nky.exe	105
PID 2996 wrote to memory of 3616	2996	OGFN Ext by Fr4nky.exe	107
PID 2996 wrote to memory of 4604	2996	OGFN Ext by Fr4nky.exe	109
PID 2996 wrote to memory of 1040	2996	OGFN Ext by Fr4nky.exe	111
PID 2996 wrote to memory of 4504	2996	OGFN Ext by Fr4nky.exe	113
PID 2996 wrote to memory of 1404	2996	OGFN Ext by Fr4nky.exe	115
PID 2996 wrote to memory of 3444	2996	OGFN Ext by Fr4nky.exe	146
PID 2996 wrote to memory of 3060	2996	OGFN Ext by Fr4nky.exe	275
PID 2996 wrote to memory of 3528	2996	OGFN Ext by Fr4nky.exe	312
PID 2996 wrote to memory of 2668	2996	OGFN Ext by Fr4nky.exe	313
PID 2996 wrote to memory of 2864	2996	OGFN Ext by Fr4nky.exe	198
PID 2996 wrote to memory of 2144	2996	OGFN Ext by Fr4nky.exe	127
PID 2996 wrote to memory of 3396	2996	OGFN Ext by Fr4nky.exe	211
PID 2996 wrote to memory of 1360	2996	OGFN Ext by Fr4nky.exe	131
PID 2996 wrote to memory of 2976	2996	OGFN Ext by Fr4nky.exe	133
PID 2996 wrote to memory of 1864	2996	OGFN Ext by Fr4nky.exe	230
PID 2996 wrote to memory of 1828	2996	OGFN Ext by Fr4nky.exe	137
PID 2996 wrote to memory of 5856	2996	OGFN Ext by Fr4nky.exe	139
PID 2996 wrote to memory of 992	2996	OGFN Ext by Fr4nky.exe	182
PID 2996 wrote to memory of 3788	2996	OGFN Ext by Fr4nky.exe	143
PID 2996 wrote to memory of 4832	2996	OGFN Ext by Fr4nky.exe	145
PID 2996 wrote to memory of 4276	2996	OGFN Ext by Fr4nky.exe	147
PID 2996 wrote to memory of 5440	2996	OGFN Ext by Fr4nky.exe	201
PID 2996 wrote to memory of 4928	2996	OGFN Ext by Fr4nky.exe	151
PID 2996 wrote to memory of 1972	2996	OGFN Ext by Fr4nky.exe	153
PID 2996 wrote to memory of 4336	2996	OGFN Ext by Fr4nky.exe	155
PID 2996 wrote to memory of 4260	2996	OGFN Ext by Fr4nky.exe	157
PID 2996 wrote to memory of 4768	2996	OGFN Ext by Fr4nky.exe	159
PID 2996 wrote to memory of 4548	2996	OGFN Ext by Fr4nky.exe	161
PID 2996 wrote to memory of 1412	2996	OGFN Ext by Fr4nky.exe	163
PID 2996 wrote to memory of 4400	2996	OGFN Ext by Fr4nky.exe	165
PID 2996 wrote to memory of 3648	2996	OGFN Ext by Fr4nky.exe	167
PID 52 wrote to memory of 3836	52	MicrosoftEdgeUpdate1.exe	173
PID 256 wrote to memory of 3724	256	MicrosoftEdgeUpdate1.exe	261
PID 52 wrote to memory of 1848	52	MicrosoftEdgeUpdate1.exe	177
PID 256 wrote to memory of 2828	256	MicrosoftEdgeUpdate1.exe	178
PID 52 wrote to memory of 5944	52	MicrosoftEdgeUpdate1.exe	269
PID 256 wrote to memory of 992	256	MicrosoftEdgeUpdate1.exe	182
PID 52 wrote to memory of 3020	52	MicrosoftEdgeUpdate1.exe	185
PID 256 wrote to memory of 2044	256	MicrosoftEdgeUpdate1.exe	186
PID 256 wrote to memory of 4816	256	MicrosoftEdgeUpdate1.exe	189
PID 52 wrote to memory of 2520	52	MicrosoftEdgeUpdate1.exe	190
PID 52 wrote to memory of 3668	52	MicrosoftEdgeUpdate1.exe	193
PID 256 wrote to memory of 3060	256	MicrosoftEdgeUpdate1.exe	275
PID 256 wrote to memory of 6088	256	MicrosoftEdgeUpdate1.exe	197
PID 52 wrote to memory of 5176	52	MicrosoftEdgeUpdate1.exe	199
PID 256 wrote to memory of 5440	256	MicrosoftEdgeUpdate1.exe	201
PID 52 wrote to memory of 5004	52	MicrosoftEdgeUpdate1.exe	320
PID 256 wrote to memory of 4232	256	MicrosoftEdgeUpdate1.exe	205
PID 52 wrote to memory of 6140	52	MicrosoftEdgeUpdate1.exe	207
PID 256 wrote to memory of 5996	256	MicrosoftEdgeUpdate1.exe	209
PID 52 wrote to memory of 3396	52	MicrosoftEdgeUpdate1.exe	211
PID 256 wrote to memory of 2188	256	MicrosoftEdgeUpdate1.exe	213
PID 52 wrote to memory of 1896	52	MicrosoftEdgeUpdate1.exe	215
PID 256 wrote to memory of 4648	256	MicrosoftEdgeUpdate1.exe	217
PID 52 wrote to memory of 4636	52	MicrosoftEdgeUpdate1.exe	219
PID 256 wrote to memory of 1532	256	MicrosoftEdgeUpdate1.exe	221

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OGFN Ext by Fr4nky.exe
"C:\Users\Admin\AppData\Local\Temp\OGFN Ext by Fr4nky.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4676
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:2988
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:5800
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4580
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1800
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:1028
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:3616
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:4604
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:1040
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4504
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:1404
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:3444
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:3060
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:3528
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:2668
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3444
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4276
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:5440
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:4928
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:1972
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:4336
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:4260
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:4768
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:4548
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:1412
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:4400
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:3648

C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:5944
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:3020
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:2520
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:3668
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:5176
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:5004
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:6140
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:3396
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:1896
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4636
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:4588
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:6072
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:4360
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:4576
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:4664
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:5472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5984
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:2992
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:6084
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:2872
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4468
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1844
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:3528
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:3304
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:5004
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:2404
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:1964
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:556

C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
"C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe" --no-startup-window --win-session-start
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:992
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:2044
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:4816
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:3060
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:6088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2864
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:5440
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:4232
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:5996
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:2188
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4648
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:1532
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4644
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:4856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1864
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:1324
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:1996
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:5280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2616
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:3476
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:3552
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:5900
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:3840
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:4804
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:3048
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:4120
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:4696
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:2668
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:5872
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...