sheetrat | 5d06bb9408693e01a99f47a4918b51cf8c4601cd92ca2075089cc80eb45c51ee

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	M1004NUS.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	StartMenuExperienceHost.exe

UAC bypass 3 TTPs 16 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/memory/5588-0-0x000001655BD80000-0x000001655BDF4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/files/0x000c00000001c540-15.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/memory/5588-0-0x000001655BD80000-0x000001655BDF4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/files/0x000c00000001c540-15.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/5588-0-0x000001655BD80000-0x000001655BDF4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000c00000001c540-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
6116	netsh.exe
3808	netsh.exe
5868	netsh.exe
4048	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
2432	M1004NUS.exe
3348	M1004NUS.exe
1384	MicrosoftEdgeCP.exe
2928	MicrosoftEdgeCP.exe
3128	StartMenuExperienceHost.exe
5216	StartMenuExperienceHost.exe
3288	M1004NUS.exe
1232	M1004NUS.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 4 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	MicrosoftEdgeCP.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	StartMenuExperienceHost.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3388	sc.exe
2256	sc.exe
4192	sc.exe
1344	sc.exe
768	sc.exe
1244	sc.exe
1588	sc.exe
4136	sc.exe
6064	sc.exe
944	sc.exe
2476	sc.exe
2676	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe
3296	cmd.exe
5256	cmd.exe
1388	cmd.exe
5772	cmd.exe
2032	cmd.exe
920	cmd.exe
4052	cmd.exe
1688	cmd.exe
1096	CMD.exe
6004	cmd.exe
4544	cmd.exe
5100	CMD.exe
3284	cmd.exe
5748	cmd.exe
3848	cmd.exe
4756	cmd.exe
832	cmd.exe
1672	CMD.exe
4364	cmd.exe
4616	cmd.exe
5852	cmd.exe
5912	CMD.exe
860	cmd.exe
576	cmd.exe
620	cmd.exe
3808	cmd.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	M1004NUS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4984	schtasks.exe
4580	schtasks.exe
1216	schtasks.exe
5556	schtasks.exe
956	schtasks.exe
4152	schtasks.exe
3716	schtasks.exe
4684	schtasks.exe
3700	schtasks.exe
3300	schtasks.exe
2328	schtasks.exe
792	schtasks.exe
2040	schtasks.exe
1320	schtasks.exe
5156	schtasks.exe
4308	schtasks.exe
3328	schtasks.exe
3736	schtasks.exe
5800	schtasks.exe
2580	schtasks.exe
4036	schtasks.exe
5188	schtasks.exe
2804	schtasks.exe
4716	schtasks.exe
488	schtasks.exe
4380	schtasks.exe
5868	schtasks.exe
1820	schtasks.exe
3904	schtasks.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4368	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	2432	M1004NUS.exe
Token: SeDebugPrivilege	3348	M1004NUS.exe
Token: SeDebugPrivilege	1384	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2928	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3128	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	5216	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3288	M1004NUS.exe
Token: SeDebugPrivilege	1232	M1004NUS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 3284	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	90
PID 3284 wrote to memory of 6116	3284	cmd.exe	92
PID 5588 wrote to memory of 768	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	93
PID 5588 wrote to memory of 2676	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	95
PID 5588 wrote to memory of 1244	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	97
PID 5588 wrote to memory of 4864	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	100
PID 5588 wrote to memory of 3904	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	103
PID 5588 wrote to memory of 4968	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	105
PID 5588 wrote to memory of 5912	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	106
PID 5588 wrote to memory of 860	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	107
PID 5588 wrote to memory of 5748	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	108
PID 5588 wrote to memory of 2032	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	109
PID 5588 wrote to memory of 920	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	114
PID 5588 wrote to memory of 4052	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	115
PID 860 wrote to memory of 3700	860	cmd.exe	119
PID 5748 wrote to memory of 5556	5748	cmd.exe	120
PID 920 wrote to memory of 5868	920	cmd.exe	121
PID 2032 wrote to memory of 4152	2032	cmd.exe	122
PID 5912 wrote to memory of 2796	5912	CMD.exe	123
PID 5588 wrote to memory of 5724	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	124
PID 4052 wrote to memory of 3300	4052	cmd.exe	127
PID 5588 wrote to memory of 2328	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	128
PID 5588 wrote to memory of 3348	5588	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	131
PID 1384 wrote to memory of 1688	1384	MicrosoftEdgeCP.exe	133
PID 1688 wrote to memory of 3808	1688	cmd.exe	135
PID 1384 wrote to memory of 3388	1384	MicrosoftEdgeCP.exe	136
PID 1384 wrote to memory of 1588	1384	MicrosoftEdgeCP.exe	138
PID 1384 wrote to memory of 4136	1384	MicrosoftEdgeCP.exe	140
PID 1384 wrote to memory of 1096	1384	MicrosoftEdgeCP.exe	142
PID 1384 wrote to memory of 3848	1384	MicrosoftEdgeCP.exe	143
PID 1384 wrote to memory of 4756	1384	MicrosoftEdgeCP.exe	144
PID 1384 wrote to memory of 6004	1384	MicrosoftEdgeCP.exe	146
PID 1384 wrote to memory of 4364	1384	MicrosoftEdgeCP.exe	147
PID 1384 wrote to memory of 832	1384	MicrosoftEdgeCP.exe	149
PID 1384 wrote to memory of 5852	1384	MicrosoftEdgeCP.exe	153
PID 1096 wrote to memory of 2528	1096	CMD.exe	156
PID 3848 wrote to memory of 3328	3848	cmd.exe	157
PID 1384 wrote to memory of 792	1384	MicrosoftEdgeCP.exe	158
PID 4756 wrote to memory of 3736	4756	cmd.exe	159
PID 6004 wrote to memory of 5188	6004	cmd.exe	161
PID 5852 wrote to memory of 3716	5852	cmd.exe	163
PID 832 wrote to memory of 2804	832	cmd.exe	165
PID 3128 wrote to memory of 576	3128	StartMenuExperienceHost.exe	170
PID 576 wrote to memory of 5868	576	cmd.exe	172
PID 3128 wrote to memory of 6064	3128	StartMenuExperienceHost.exe	173
PID 3128 wrote to memory of 944	3128	StartMenuExperienceHost.exe	175
PID 3128 wrote to memory of 2476	3128	StartMenuExperienceHost.exe	177
PID 3128 wrote to memory of 1672	3128	StartMenuExperienceHost.exe	179
PID 3128 wrote to memory of 4816	3128	StartMenuExperienceHost.exe	180
PID 3128 wrote to memory of 3296	3128	StartMenuExperienceHost.exe	182
PID 3128 wrote to memory of 620	3128	StartMenuExperienceHost.exe	183
PID 3128 wrote to memory of 5256	3128	StartMenuExperienceHost.exe	185
PID 3128 wrote to memory of 1388	3128	StartMenuExperienceHost.exe	186
PID 1672 wrote to memory of 2508	1672	CMD.exe	193
PID 3128 wrote to memory of 4984	3128	StartMenuExperienceHost.exe	194
PID 1388 wrote to memory of 4716	1388	cmd.exe	195
PID 3128 wrote to memory of 3288	3128	StartMenuExperienceHost.exe	197
PID 3296 wrote to memory of 5800	3296	cmd.exe	198
PID 620 wrote to memory of 4580	620	cmd.exe	199
PID 5256 wrote to memory of 2580	5256	cmd.exe	200
PID 2432 wrote to memory of 4544	2432	M1004NUS.exe	202
PID 4544 wrote to memory of 4048	4544	cmd.exe	204
PID 2432 wrote to memory of 2256	2432	M1004NUS.exe	205
PID 2432 wrote to memory of 4192	2432	M1004NUS.exe	207

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6116
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:768
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2676
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1244
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_0035816e" /F
  2⤵
  PID:4864
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_0035816e" /XML "C:\Users\Admin\AppData\Local\Temp\69f22ff2-9dd4-4ce6-9127-490b538f6352.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:4968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Windows Powershell" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Windows Powershell"
    3⤵
    PID:2796
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4152
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3300
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Consolidator_033d026f" /F
  2⤵
  PID:5724
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Consolidator_033d026f" /XML "C:\Users\Admin\AppData\Local\Temp\5cc8e4e8-cd31-4fe8-b9fe-bd8bc0201463.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2328
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3348

C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-13_cad8568ac1b1a070123b93503b065663_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4048
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2256
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4192
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Windows Powershell" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5100
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Windows Powershell"
    3⤵
    PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:488
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:956
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_c6dbdfd6" /F
  2⤵
  PID:4152
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_c6dbdfd6" /XML "C:\Users\Admin\AppData\Local\Temp\761f81ca-d8d1-4b7f-98ae-063585bbd62f.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_88e41ac5" /F
  2⤵
  PID:4316
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_88e41ac5" /XML "C:\Users\Admin\AppData\Local\Temp\5b9261e6-7466-46f0-869c-ed841f5a6a54.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1820
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_acd1d54b" /F
  2⤵
  PID:1204
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_acd1d54b" /XML "C:\Users\Admin\AppData\Local\Temp\280121d6-24dd-410a-81c5-66f6e3d7ddc0.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4308
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_8509c69f" /F
  2⤵
  PID:5472
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_8509c69f" /XML "C:\Users\Admin\AppData\Local\Temp\ec02f5be-2b5f-4c42-8f3a-5c2dc35f6a77.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4684
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "UsbCeip_7b25b752" /F
  2⤵
  PID:4976
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "UsbCeip_7b25b752" /XML "C:\Users\Admin\AppData\Local\Temp\cb669cd8-0610-433b-a165-9380fe8a0afe.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1216
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_84128e3a" /F
  2⤵
  PID:2348
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_84128e3a" /XML "C:\Users\Admin\AppData\Local\Temp\56aab4f9-aa56-42ed-94d3-411a2d2ed130.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1320

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1384
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\System32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3808
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3388
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1588
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4136
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Windows Powershell" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /F /TN "Windows Powershell"
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Windows Powershell" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3328
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5188
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_938b680c" /F
  2⤵
  PID:4364
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3716
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_938b680c" /XML "C:\Users\Admin\AppData\Local\Temp\2c5c52c8-1467-4866-941d-6b02a3973a90.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:792

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\MicrosoftEdgeCP.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe
"C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3128
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\System32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5868
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:6064
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:944
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2476
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Windows Powershell" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /F /TN "Windows Powershell"
    3⤵
    PID:2508
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "CCleanerSkipUAC_8fc2b629" /F
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5800
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /tn "Windows Powershell_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "CCleanerSkipUAC_8fc2b629" /XML "C:\Users\Admin\AppData\Local\Temp\eb8f5e14-4a22-4b48-87ff-4879ce89e348.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4984
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3288

C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe
C:\ProgramData\Microsoft\Windows\DeviceMetadata\Store\StartMenuExperienceHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry