darksiderat | 8ff90319b7974e0601eaa4eaeffd0bb73eed121fafe6de03f7a365dad08586de

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1"	MsMpEng.exe

Modifies firewall policy service 3 TTPs 2 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	MsMpEng.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	MsMpEng.exe

UPX dump on OEP (original entry point) 22 IoCs

resource	yara_rule
behavioral2/files/0x000200000001af46-141.dat	UPX
behavioral2/memory/5980-142-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/5980-162-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3504-181-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3332-246-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4504-249-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4504-248-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/5340-871-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/3540-874-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1936-1380-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1692-1407-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1692-1466-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/5068-1468-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2452-2668-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2020-2666-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/4976-2674-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/2044-2664-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/6892-3260-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/7008-3262-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/7144-3264-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/6932-3894-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX
behavioral2/memory/1692-3896-0x0000000000400000-0x00000000004CD000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
5980	dControl.exe
3504	dControl.exe
4504	dControl.exe
3332	dControl.exe

Loads dropped DLL 21 IoCs

pid	Process
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1632	powershell.exe
5668	powershell.exe
5020	powershell.exe
2680	powershell.exe
2568	powershell.exe
696	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
8	api.ipify.org

Modifies Security services 2 TTPs 3 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe

AutoIT Executable 20 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5980-162-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3504-181-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3332-246-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4504-249-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4504-248-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5340-871-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3540-874-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1936-1380-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1692-1407-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1692-1466-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5068-1468-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2452-2668-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2020-2666-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/4976-2674-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/2044-2664-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6892-3260-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7008-3262-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/7144-3264-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/6932-3894-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1692-3896-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2016 set thread context of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000200000001af46-141.dat	upx
behavioral2/memory/5980-142-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5980-162-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3504-181-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3332-246-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4504-249-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4504-248-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5340-871-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3540-874-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1936-1380-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1692-1407-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1692-1466-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5068-1468-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2452-2668-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2020-2666-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/4976-2674-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2044-2664-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6892-3260-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7008-3262-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/7144-3264-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/6932-3894-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1692-3896-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe
File opened for modification	C:\Windows\SystemTemp\tmp3402.tmp	mofcomp.exe
File created	C:\Windows\SystemTemp\8C4D3AC0-9F2E-877A-9952-2B69B462D8BC.man	MsMpEng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 1 IoCs

pid	Process
5020	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5980	dControl.exe
5980	dControl.exe
5980	dControl.exe
5980	dControl.exe
5980	dControl.exe
5980	dControl.exe
3504	dControl.exe
3504	dControl.exe
3504	dControl.exe
3504	dControl.exe
3504	dControl.exe
3504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
3332	dControl.exe
3332	dControl.exe
3332	dControl.exe
3332	dControl.exe
3332	dControl.exe
3332	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4504	dControl.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
5448	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5980	dControl.exe
Token: SeIncreaseQuotaPrivilege	5980	dControl.exe
Token: 0	5980	dControl.exe
Token: SeDebugPrivilege	3504	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3504	dControl.exe
Token: SeIncreaseQuotaPrivilege	3504	dControl.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	5448	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	5448	MsMpEng.exe
Token: SeTcbPrivilege	5448	MsMpEng.exe
Token: SeSecurityPrivilege	5448	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	5448	MsMpEng.exe
Token: SeLoadDriverPrivilege	5448	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	5448	MsMpEng.exe
Token: SeBackupPrivilege	5448	MsMpEng.exe
Token: SeRestorePrivilege	5448	MsMpEng.exe
Token: SeShutdownPrivilege	5448	MsMpEng.exe
Token: SeDebugPrivilege	5448	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	5448	MsMpEng.exe
Token: SeChangeNotifyPrivilege	5448	MsMpEng.exe
Token: SeImpersonatePrivilege	5448	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeDebugPrivilege	4504	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4504	dControl.exe
Token: SeIncreaseQuotaPrivilege	4504	dControl.exe
Token: 0	4504	dControl.exe
Token: SeSecurityPrivilege	3316	mofcomp.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTakeOwnershipPrivilege	3312	svchost.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeShutdownPrivilege	5672	svchost.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeSecurityPrivilege	1436	wevtutil.exe
Token: SeBackupPrivilege	1436	wevtutil.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeTcbPrivilege	3312	svchost.exe
Token: SeSecurityPrivilege	2372	wevtutil.exe
Token: SeBackupPrivilege	2372	wevtutil.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe
4504	dControl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
616	explorer.exe
2672	SecHealthUI.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 3220	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4424 wrote to memory of 2016	4424	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 2776	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2016 wrote to memory of 3992	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 2016 wrote to memory of 5980	2016	2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 4504 wrote to memory of 1852	4504	dControl.exe	103
PID 4504 wrote to memory of 3332	4504	dControl.exe	106
PID 5448 wrote to memory of 3316	5448	MsMpEng.exe	107
PID 5448 wrote to memory of 5020	5448	MsMpEng.exe	168
PID 3312 wrote to memory of 2996	3312	svchost.exe	136
PID 5448 wrote to memory of 1436	5448	MsMpEng.exe	123
PID 5448 wrote to memory of 2372	5448	MsMpEng.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_ed554d9cb7c4fc581e6e1c893ae997bd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    3⤵
    PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3992
- - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
    C:\Users\Admin\AppData\Local\supporttool\dControl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
  - - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
      C:\Users\Admin\AppData\Local\supporttool\dControl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3504
    - - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /TI
        5⤵
        Modifies security service
        Executes dropped EXE
        Modifies Security services
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:1852
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1632
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:3540
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:3332
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|4688|
        6⤵
        
        PID:5340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5668
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender:
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:1936
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:1692
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:1732
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|5744|
        6⤵
        
        PID:5068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5020
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:2044
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:4260
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|5472|
        6⤵
        
        PID:2020
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|5472|3888|
        6⤵
        
        PID:2452
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:2640
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|5472|3888|3252|4908|
        6⤵
        
        PID:4976
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2680
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender:
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:6892
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|6888|
        6⤵
        
        PID:7144
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:7152
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|6888|7120|
        6⤵
        
        PID:7008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2568
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|
        6⤵
        
        PID:6932
      - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        6⤵
        
        PID:4400
      - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\supporttool\dControl.exe
        
        "C:\Users\Admin\AppData\Local\supporttool\dControl.exe" /EXP |3988|1940|
        6⤵
        
        PID:1692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:2996
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:2536
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:4688
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:3448
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:5732
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:4144
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:3968
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:6992
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:3276
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:6684
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:6980
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:6824
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:4260

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\8C4D3AC0-9F2E-877A-9952-2B69B462D8BC.man
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\8C4D3AC0-9F2E-877A-9952-2B69B462D8BC.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:4748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:616

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2604

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5836

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2252
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:548

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:2596
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1816
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5820
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 85791535-CBE4-649F-31C8-8462E5068ED0
  2⤵
  PID:5748
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6696
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1060
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2460

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:5732
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3252
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6424

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:7096
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4836
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:4652
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:6444

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6912
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5860
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:6340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry