19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe

Modifies firewall policy service 3 TTPs 6 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	MsMpEng.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
1712	sg.tmp
936	dControl.exe
2364	dControl.exe
5464	dControl.exe
4956	dControl.exe
3636	dControl.exe
2560	dControl.exe

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
3328	powershell.exe
5596	powershell.exe
5888	powershell.exe
4748	powershell.exe
3064	powershell.exe
1056	powershell.exe
3304	powershell.exe
3756	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/936-35-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2364-54-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4956-134-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5464-135-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5464-138-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3636-722-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2560-1262-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1604-1777-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5592-2426-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5720-2428-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5968-2973-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1464-3619-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1488-3621-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5272-4133-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3256-4771-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/240-4773-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5720-5296-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4c7-12.dat	upx
behavioral2/memory/936-15-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/936-35-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2364-54-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4956-134-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5464-135-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5464-138-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3636-722-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2560-1262-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1604-1777-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5592-2426-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5720-2428-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5968-2973-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1464-3619-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1488-3621-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5272-4133-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3256-4771-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/240-4773-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5720-5296-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\22CAF14C-DC28-8893-56F0-45F822638823.man	MsMpEng.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s1qeb2a1.gbq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_voyn4r4t.erd.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_aozfidlf.sko.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_akeluskk.tak.psm1	powershell.exe
File created	C:\Windows\SystemTemp\MpCmdRun-3a-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SystemTemp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_15fpiomm.dto.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jvmsmzgq.iig.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nuhg041c.cn1.psm1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\tmpDC71.tmp	mofcomp.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_halg4y1f.efk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o4r1zbic.sbe.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_d3p5ccmp.t0c.ps1	powershell.exe
File opened for modification	C:\Windows\SystemTemp\MpCmdRun.log	mpcmdrun.exe
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3316	cmd.exe
4388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5508	PING.EXE
3256	PING.EXE
1272	PING.EXE
1172	PING.EXE

Kills process with taskkill 1 IoCs

pid	Process
5592	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\""	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\DISABLED - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\DISABLED - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	MsMpEng.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
5508	PING.EXE
3256	PING.EXE
1272	PING.EXE
1172	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
936	dControl.exe
936	dControl.exe
936	dControl.exe
936	dControl.exe
936	dControl.exe
936	dControl.exe
5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
2364	dControl.exe
2364	dControl.exe
2364	dControl.exe
2364	dControl.exe
2364	dControl.exe
2364	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
4956	dControl.exe
4956	dControl.exe
4956	dControl.exe
4956	dControl.exe
4956	dControl.exe
4956	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5888	powershell.exe
5888	powershell.exe
5464	dControl.exe
5464	dControl.exe
5888	powershell.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5464	dControl.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
5624	MsMpEng.exe
3152	MsMpEng.exe
3152	MsMpEng.exe
3152	MsMpEng.exe
4232	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeRestorePrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: 33	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeCreateGlobalPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: 33	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: 33	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeRestorePrivilege	1712	sg.tmp
Token: 35	1712	sg.tmp
Token: SeSecurityPrivilege	1712	sg.tmp
Token: SeSecurityPrivilege	1712	sg.tmp
Token: 33	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeDebugPrivilege	936	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	936	dControl.exe
Token: SeIncreaseQuotaPrivilege	936	dControl.exe
Token: 0	936	dControl.exe
Token: SeDebugPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeDebugPrivilege	2364	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2364	dControl.exe
Token: SeIncreaseQuotaPrivilege	2364	dControl.exe
Token: 33	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeBackupPrivilege	3088	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeRestorePrivilege	3088	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: 33	3088	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeIncBasePriorityPrivilege	3088	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
Token: SeAssignPrimaryTokenPrivilege	5624	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	5624	MsMpEng.exe
Token: SeTcbPrivilege	5624	MsMpEng.exe
Token: SeSecurityPrivilege	5624	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	5624	MsMpEng.exe
Token: SeLoadDriverPrivilege	5624	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	5624	MsMpEng.exe
Token: SeBackupPrivilege	5624	MsMpEng.exe
Token: SeRestorePrivilege	5624	MsMpEng.exe
Token: SeShutdownPrivilege	5624	MsMpEng.exe
Token: SeDebugPrivilege	5624	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	5624	MsMpEng.exe
Token: SeChangeNotifyPrivilege	5624	MsMpEng.exe
Token: SeImpersonatePrivilege	5624	MsMpEng.exe
Token: SeDebugPrivilege	5464	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5464	dControl.exe
Token: SeIncreaseQuotaPrivilege	5464	dControl.exe
Token: 0	5464	dControl.exe
Token: SeSecurityPrivilege	1060	mofcomp.exe
Token: SeDebugPrivilege	5592	taskkill.exe
Token: SeSecurityPrivilege	5428	wevtutil.exe
Token: SeBackupPrivilege	5428	wevtutil.exe
Token: SeSecurityPrivilege	1432	wevtutil.exe
Token: SeBackupPrivilege	1432	wevtutil.exe
Token: SeDebugPrivilege	5624	MsMpEng.exe
Token: SeBackupPrivilege	5624	MsMpEng.exe
Token: SeRestorePrivilege	5624	MsMpEng.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5888	powershell.exe
Token: SeIncreaseQuotaPrivilege	5888	powershell.exe
Token: SeSecurityPrivilege	5888	powershell.exe
Token: SeTakeOwnershipPrivilege	5888	powershell.exe
Token: SeLoadDriverPrivilege	5888	powershell.exe
Token: SeSystemtimePrivilege	5888	powershell.exe
Token: SeBackupPrivilege	5888	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
3132	SecurityHealthSystray.exe
3132	SecurityHealthSystray.exe
3132	SecurityHealthSystray.exe
3132	SecurityHealthSystray.exe
5464	dControl.exe
3132	SecurityHealthSystray.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
2604	SecurityHealthSystray.exe
2604	SecurityHealthSystray.exe
2604	SecurityHealthSystray.exe
2604	SecurityHealthSystray.exe
5464	dControl.exe
2604	SecurityHealthSystray.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
3132	SecurityHealthSystray.exe
3132	SecurityHealthSystray.exe
3132	SecurityHealthSystray.exe
5464	dControl.exe
3132	SecurityHealthSystray.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
2604	SecurityHealthSystray.exe
2604	SecurityHealthSystray.exe
2604	SecurityHealthSystray.exe
5464	dControl.exe
2604	SecurityHealthSystray.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe
5464	dControl.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4348	explorer.exe
3308	explorer.exe
4688	explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 3316	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe	89
PID 5604 wrote to memory of 1712	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe	91
PID 5604 wrote to memory of 936	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe	93
PID 5604 wrote to memory of 3088	5604	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe	100
PID 3088 wrote to memory of 4388	3088	19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe	101
PID 4388 wrote to memory of 5508	4388	cmd.exe	103
PID 4388 wrote to memory of 3256	4388	cmd.exe	104
PID 4388 wrote to memory of 1272	4388	cmd.exe	105
PID 4388 wrote to memory of 1172	4388	cmd.exe	106
PID 5464 wrote to memory of 4956	5464	dControl.exe	112
PID 5464 wrote to memory of 1184	5464	dControl.exe	113
PID 5624 wrote to memory of 1060	5624	MsMpEng.exe	115
PID 4348 wrote to memory of 3132	4348	explorer.exe	118
PID 5624 wrote to memory of 5592	5624	MsMpEng.exe	121
PID 5624 wrote to memory of 5428	5624	MsMpEng.exe	123
PID 5624 wrote to memory of 1432	5624	MsMpEng.exe	125
PID 5464 wrote to memory of 5888	5464	dControl.exe	127
PID 5464 wrote to memory of 3636	5464	dControl.exe	134
PID 5464 wrote to memory of 1064	5464	dControl.exe	135
PID 5464 wrote to memory of 4748	5464	dControl.exe	138
PID 3308 wrote to memory of 2604	3308	explorer.exe	141
PID 3152 wrote to memory of 5880	3152	MsMpEng.exe	143
PID 3152 wrote to memory of 6068	3152	MsMpEng.exe	187
PID 5464 wrote to memory of 2560	5464	dControl.exe	153
PID 5464 wrote to memory of 3592	5464	dControl.exe	154
PID 5464 wrote to memory of 3064	5464	dControl.exe	242

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
"C:\Users\Admin\AppData\Local\Temp\19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:3316
- C:\Users\Admin\AppData\Local\Temp\~5413012055482345748~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
  "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
    C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /TI
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies Windows Defender TamperProtection settings
      Modifies security service
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Windows security modification
      Indicator Removal: Clear Persistence
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4956
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:1184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3636
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        Drops file in Windows directory
        
        PID:1064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:4748
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2560
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:3064
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:1604
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:5392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3736
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:5592
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:1012
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|4040|
        5⤵
        
        PID:5720
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1056
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:244
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:5968
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:5720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3328
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:1464
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2436
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|4400|
        5⤵
        
        PID:1488
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3304
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:5272
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5596
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:240
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:3304
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|5808|
        5⤵
        
        PID:3256
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:1812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3756
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\关闭Windows安全中心\dControl.exe" /EXP |5688|
        5⤵
        
        PID:5720
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:2420
- C:\Users\Admin\AppData\Local\Temp\19d22ccd4d27cb325d3eadcdb724922211f02ac209c97d2f83896b725798480a.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~1418178911701868259.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~1418178911701868259.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3256
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1272
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1172

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\22CAF14C-DC28-8893-56F0-45F822638823.man
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5428
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\22CAF14C-DC28-8893-56F0-45F822638823.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:3192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3132

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2956

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4448

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4064

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies firewall policy service
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Drops file in Windows directory
  PID:5880
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  - Drops file in Windows directory
  PID:1712
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2604

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2268

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5248

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies firewall policy service
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:4232
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:2436
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4232 -s 1408
  2⤵
  PID:4960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4688
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2896

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:616

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4232 -i 4232 -h 392 -j 456 -s 448 -d 0
1⤵
PID:5980

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5048
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1216
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:4824
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:1820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5248
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1464

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5152

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
1⤵
PID:6068

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5184

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5560
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:5152
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1584
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1576
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5448

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3328

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3520

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1264

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5532

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2356
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5356
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3724
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1112
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1108

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4104

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4200

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:1056
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:5952
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:5584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5852
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2488
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5544

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2464

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5864

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:3148
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2492
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5116
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:952
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1988

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4764

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5592
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:5816
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5448
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1804
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1904

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3664

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4072

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4132
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4240

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3280

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry