1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe

Modifies firewall policy service 3 TTPs 2 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	MsMpEng.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6744	powershell.exe
6596	powershell.exe
5756	powershell.exe
6856	powershell.exe
752	powershell.exe
6812	powershell.exe
1380	powershell.exe
7092	powershell.exe
7068	powershell.exe
6860	powershell.exe
3936	powershell.exe
4508	powershell.exe
6584	powershell.exe
3540	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

Modifies Security services 2 TTPs 6 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	dControl.exe

AutoIT Executable 43 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2420-19-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4152-37-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5828-109-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/620-145-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1112-146-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5828-144-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5828-183-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5664-360-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6112-766-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5164-768-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5044-853-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3316-856-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7060-2002-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/8-2004-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7012-2009-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4424-2010-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3512-2133-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6464-2221-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7160-2223-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6204-2834-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1248-2836-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6464-2832-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3032-2830-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1988-3379-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4724-3381-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6900-3882-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6900-3922-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6776-3924-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1492-4462-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6540-4461-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4464-5029-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1476-5031-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6432-5588-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1248-5590-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2752-6126-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6356-6128-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6900-6637-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4780-6675-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6972-6677-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1196-7295-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4068-7297-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6192-7844-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3408-7848-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2420-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2420-19-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4152-37-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5828-109-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/620-145-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1112-146-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5828-144-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5828-183-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5664-360-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6112-766-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5164-768-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5044-853-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3316-856-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7060-2002-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/8-2004-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7012-2009-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4424-2010-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3512-2133-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6464-2221-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7160-2223-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6204-2834-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1248-2836-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6464-2832-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3032-2830-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1988-3379-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4724-3381-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6900-3882-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6900-3922-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6776-3924-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1492-4462-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6540-4461-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4464-5029-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1476-5031-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6432-5588-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1248-5590-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2752-6126-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6356-6128-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6900-6637-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4780-6675-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6972-6677-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1196-7295-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4068-7297-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6192-7844-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3408-7848-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe
File opened for modification	C:\Windows\SystemTemp\tmp191C.tmp	mofcomp.exe
File created	C:\Windows\SystemTemp\A628294E-D9E3-3A27-31DD-8D6553E2757C.man	MsMpEng.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e4i4xfnv.2gu.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wmpxgqk3.5sq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_se30hnyo.1xw.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_33zwsyj5.cak.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 1 IoCs

pid	Process
3408	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	dControl.exe
2420	dControl.exe
2420	dControl.exe
2420	dControl.exe
2420	dControl.exe
2420	dControl.exe
4152	dControl.exe
4152	dControl.exe
4152	dControl.exe
4152	dControl.exe
4152	dControl.exe
4152	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
1112	dControl.exe
1112	dControl.exe
620	dControl.exe
620	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
1112	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
620	dControl.exe
5828	dControl.exe
5828	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5828	dControl.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
808	Process not Found
248	MsMpEng.exe
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2420	dControl.exe
Token: SeIncreaseQuotaPrivilege	2420	dControl.exe
Token: 0	2420	dControl.exe
Token: SeDebugPrivilege	4152	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4152	dControl.exe
Token: SeIncreaseQuotaPrivilege	4152	dControl.exe
Token: SeDebugPrivilege	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5828	dControl.exe
Token: SeIncreaseQuotaPrivilege	5828	dControl.exe
Token: 0	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	248	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	248	MsMpEng.exe
Token: SeTcbPrivilege	248	MsMpEng.exe
Token: SeSecurityPrivilege	248	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	248	MsMpEng.exe
Token: SeLoadDriverPrivilege	248	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	248	MsMpEng.exe
Token: SeBackupPrivilege	248	MsMpEng.exe
Token: SeRestorePrivilege	248	MsMpEng.exe
Token: SeShutdownPrivilege	248	MsMpEng.exe
Token: SeDebugPrivilege	248	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	248	MsMpEng.exe
Token: SeChangeNotifyPrivilege	248	MsMpEng.exe
Token: SeImpersonatePrivilege	248	MsMpEng.exe
Token: SeDebugPrivilege	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5828	dControl.exe
Token: SeIncreaseQuotaPrivilege	5828	dControl.exe
Token: 0	5828	dControl.exe
Token: SeSecurityPrivilege	1836	mofcomp.exe
Token: SeDebugPrivilege	3408	taskkill.exe
Token: SeShutdownPrivilege	3192	svchost.exe
Token: SeSecurityPrivilege	4612	wevtutil.exe
Token: SeBackupPrivilege	4612	wevtutil.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeSecurityPrivilege	4984	wevtutil.exe
Token: SeBackupPrivilege	4984	wevtutil.exe
Token: SeDebugPrivilege	248	MsMpEng.exe
Token: SeBackupPrivilege	248	MsMpEng.exe
Token: SeRestorePrivilege	248	MsMpEng.exe
Token: SeAssignPrimaryTokenPrivilege	3936	powershell.exe
Token: SeIncreaseQuotaPrivilege	3936	powershell.exe
Token: SeSecurityPrivilege	3936	powershell.exe
Token: SeTakeOwnershipPrivilege	3936	powershell.exe
Token: SeLoadDriverPrivilege	3936	powershell.exe
Token: SeSystemtimePrivilege	3936	powershell.exe
Token: SeBackupPrivilege	3936	powershell.exe
Token: SeRestorePrivilege	3936	powershell.exe
Token: SeShutdownPrivilege	3936	powershell.exe
Token: SeSystemEnvironmentPrivilege	3936	powershell.exe
Token: SeUndockPrivilege	3936	powershell.exe
Token: SeManageVolumePrivilege	3936	powershell.exe
Token: SeDebugPrivilege	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5828	dControl.exe
Token: SeIncreaseQuotaPrivilege	5828	dControl.exe
Token: 0	5828	dControl.exe
Token: SeDebugPrivilege	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5828	dControl.exe
Token: SeIncreaseQuotaPrivilege	5828	dControl.exe
Token: 0	5828	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2972	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	2972	MsMpEng.exe
Token: SeTcbPrivilege	2972	MsMpEng.exe
Token: SeSecurityPrivilege	2972	MsMpEng.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
1444	SecurityHealthSystray.exe
1444	SecurityHealthSystray.exe
1444	SecurityHealthSystray.exe
1444	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
1444	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5032	SecurityHealthSystray.exe
5032	SecurityHealthSystray.exe
5032	SecurityHealthSystray.exe
5032	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
1444	SecurityHealthSystray.exe
1444	SecurityHealthSystray.exe
1444	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
1444	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5032	SecurityHealthSystray.exe
5032	SecurityHealthSystray.exe
5032	SecurityHealthSystray.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe
5828	dControl.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	explorer.exe
4512	explorer.exe
3212	SecHealthUI.exe
4612	explorer.exe
5744	explorer.exe
1772	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 620	5828	dControl.exe	99
PID 5828 wrote to memory of 824	5828	dControl.exe	100
PID 5828 wrote to memory of 1112	5828	dControl.exe	102
PID 248 wrote to memory of 1836	248	MsMpEng.exe	105
PID 4512 wrote to memory of 1444	4512	explorer.exe	110
PID 248 wrote to memory of 3408	248	MsMpEng.exe	163
PID 248 wrote to memory of 4612	248	MsMpEng.exe	135
PID 5828 wrote to memory of 3936	5828	dControl.exe	236
PID 248 wrote to memory of 4984	248	MsMpEng.exe	125
PID 5828 wrote to memory of 5664	5828	dControl.exe	132
PID 5828 wrote to memory of 6140	5828	dControl.exe	153
PID 4612 wrote to memory of 5032	4612	explorer.exe	136
PID 5828 wrote to memory of 6112	5828	dControl.exe	138
PID 5828 wrote to memory of 5164	5828	dControl.exe	143
PID 5828 wrote to memory of 5044	5828	dControl.exe	302
PID 5828 wrote to memory of 2392	5828	dControl.exe	150
PID 5828 wrote to memory of 3316	5828	dControl.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender TamperProtection settings
    - Modifies security service
    - Event Triggered Execution: Image File Execution Options Injection
    - Windows security modification
    - Indicator Removal: Clear Persistence
    - Modifies Security services
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:620
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:824
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|5252|
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3936
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6140
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender:
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|4208|5744|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:2392
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6140
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6024|
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3408
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:7012
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:7020
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|7004|
      4⤵
      PID:7060
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|7004|7052|
      4⤵
      PID:4424
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4608
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|7004|7052|3604|956|
      4⤵
      PID:8
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4508
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender:
      4⤵
      PID:360
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:3512
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:7160
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:7156
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|5744|
      4⤵
      PID:6464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6812
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:3032
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:7120
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6600|
      4⤵
      PID:1248
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6600|6340|
      4⤵
      PID:6204
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:2524
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6600|6340|6212|
      4⤵
      PID:6464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1380
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:1988
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4560
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|4460|
      4⤵
      PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6584
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:6776
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6852
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|2016|
      4⤵
      PID:6900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3540
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:1492
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3824
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|4108|
      4⤵
      PID:6540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6744
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:4464
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6272
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|7080|
      4⤵
      PID:1476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7092
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|
      4⤵
      PID:6432
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5268
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6772|
      4⤵
      PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6596
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|
      4⤵
      PID:6356
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:7036
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|1252|
      4⤵
      PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5756
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender:
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|
      4⤵
      PID:6900
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|
      4⤵
      PID:4780
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3600
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|7048|
      4⤵
      PID:6972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7068
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|
      4⤵
      PID:1196
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:7152
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|6688|
      4⤵
      PID:4068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6856
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|
      4⤵
      PID:6192
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6848
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3468|6776|6708|3888|3084|2840|6896|6176|4664|6936|6636|1988|4312|6376|6140|6788|
      4⤵
      PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6860

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\A628294E-D9E3-3A27-31DD-8D6553E2757C.man
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\A628294E-D9E3-3A27-31DD-8D6553E2757C.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:5112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1444

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4216

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3052

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6140

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:400

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3324

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5032

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1772

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1548

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies registry class
PID:3612
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1476
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5712
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey C29399C7-F916-50F9-0ABB-E6AE4DB273B4
  2⤵
  PID:3404
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:7048
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:7088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:1912
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2560

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:956
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6460

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6932

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6940

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6948

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6384

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:7020
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2776
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3364
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:2976

C:\Program Files\Windows Defender\MpDefenderCoreService.exe
"C:\Program Files\Windows Defender\MpDefenderCoreService.exe"
1⤵
PID:6800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4736

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:696

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6188

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6604
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3936
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:4880
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:7140

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6348

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:7088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6692

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4644
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6148
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3392
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6788

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:964

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:7104

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:7036

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:3324
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4448
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6816
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:1884

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:7084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:704

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2804
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6940
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3408
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:3084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6576

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5044

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6300
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3512
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6636
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6172

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4388

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1572

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6536
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6756
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2764

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1068

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3084

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6140

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:1484
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6516
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 1484 -s 2108
  2⤵
  PID:6188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6368
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6952

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7104

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 1484 -i 1484 -h 436 -j 448 -s 440 -d 0
1⤵
PID:2660

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2972

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5380

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6428
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6260
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6524
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1488
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6500

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6168

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4408

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4556
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:852
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5132
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1212
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:7044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6728

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2984

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4724

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5692
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4972
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6316
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:1440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6724
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5044

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5660

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry