a0c08bc8c4b265d0a01ce247397c72f44a046ac68dc895415771bf3901c3ada8

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	reg.exe

Modifies firewall policy service 3 TTPs 2 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	reg.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	reg.exe

Disables RegEdit via registry modification 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2320	netsh.exe
1272	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1144	dismhost.exe

Loads dropped DLL 23 IoCs

pid	Process
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe
1144	dismhost.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

persistence privilege_escalation

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = 73006300650063006c00690000000000	reg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3344	sc.exe
4424	sc.exe
2252	sc.exe
2640	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2952	cmd.exe
808	cmd.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
580	timeout.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"%1\" %*"	reg.exe

Modifies registry key 1 TTPs 25 IoCs

Modify Registry

pid	Process
4264	reg.exe
1872	reg.exe
4760	reg.exe
1496	reg.exe
684	reg.exe
2740	reg.exe
4288	reg.exe
5060	reg.exe
2156	reg.exe
3632	reg.exe
4984	reg.exe
1240	reg.exe
3800	reg.exe
3324	reg.exe
1704	reg.exe
2684	reg.exe
1520	reg.exe
688	reg.exe
1560	reg.exe
2308	reg.exe
2412	reg.exe
1080	reg.exe
3832	reg.exe
912	reg.exe
4852	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4608	Dism.exe
Token: SeRestorePrivilege	4608	Dism.exe
Token: SeIncreaseQuotaPrivilege	1608	WMIC.exe
Token: SeSecurityPrivilege	1608	WMIC.exe
Token: SeTakeOwnershipPrivilege	1608	WMIC.exe
Token: SeLoadDriverPrivilege	1608	WMIC.exe
Token: SeSystemProfilePrivilege	1608	WMIC.exe
Token: SeSystemtimePrivilege	1608	WMIC.exe
Token: SeProfSingleProcessPrivilege	1608	WMIC.exe
Token: SeIncBasePriorityPrivilege	1608	WMIC.exe
Token: SeCreatePagefilePrivilege	1608	WMIC.exe
Token: SeBackupPrivilege	1608	WMIC.exe
Token: SeRestorePrivilege	1608	WMIC.exe
Token: SeShutdownPrivilege	1608	WMIC.exe
Token: SeDebugPrivilege	1608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1608	WMIC.exe
Token: SeRemoteShutdownPrivilege	1608	WMIC.exe
Token: SeUndockPrivilege	1608	WMIC.exe
Token: SeManageVolumePrivilege	1608	WMIC.exe
Token: 33	1608	WMIC.exe
Token: 34	1608	WMIC.exe
Token: 35	1608	WMIC.exe
Token: 36	1608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1608	WMIC.exe
Token: SeSecurityPrivilege	1608	WMIC.exe
Token: SeTakeOwnershipPrivilege	1608	WMIC.exe
Token: SeLoadDriverPrivilege	1608	WMIC.exe
Token: SeSystemProfilePrivilege	1608	WMIC.exe
Token: SeSystemtimePrivilege	1608	WMIC.exe
Token: SeProfSingleProcessPrivilege	1608	WMIC.exe
Token: SeIncBasePriorityPrivilege	1608	WMIC.exe
Token: SeCreatePagefilePrivilege	1608	WMIC.exe
Token: SeBackupPrivilege	1608	WMIC.exe
Token: SeRestorePrivilege	1608	WMIC.exe
Token: SeShutdownPrivilege	1608	WMIC.exe
Token: SeDebugPrivilege	1608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1608	WMIC.exe
Token: SeRemoteShutdownPrivilege	1608	WMIC.exe
Token: SeUndockPrivilege	1608	WMIC.exe
Token: SeManageVolumePrivilege	1608	WMIC.exe
Token: 33	1608	WMIC.exe
Token: 34	1608	WMIC.exe
Token: 35	1608	WMIC.exe
Token: 36	1608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3512	WMIC.exe
Token: SeSecurityPrivilege	3512	WMIC.exe
Token: SeTakeOwnershipPrivilege	3512	WMIC.exe
Token: SeLoadDriverPrivilege	3512	WMIC.exe
Token: SeSystemProfilePrivilege	3512	WMIC.exe
Token: SeSystemtimePrivilege	3512	WMIC.exe
Token: SeProfSingleProcessPrivilege	3512	WMIC.exe
Token: SeIncBasePriorityPrivilege	3512	WMIC.exe
Token: SeCreatePagefilePrivilege	3512	WMIC.exe
Token: SeBackupPrivilege	3512	WMIC.exe
Token: SeRestorePrivilege	3512	WMIC.exe
Token: SeShutdownPrivilege	3512	WMIC.exe
Token: SeDebugPrivilege	3512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3512	WMIC.exe
Token: SeRemoteShutdownPrivilege	3512	WMIC.exe
Token: SeUndockPrivilege	3512	WMIC.exe
Token: SeManageVolumePrivilege	3512	WMIC.exe
Token: 33	3512	WMIC.exe
Token: 34	3512	WMIC.exe
Token: 35	3512	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3588	808	cmd.exe	81
PID 808 wrote to memory of 3768	808	cmd.exe	82
PID 3768 wrote to memory of 1148	3768	net.exe	83
PID 808 wrote to memory of 580	808	cmd.exe	84
PID 808 wrote to memory of 4608	808	cmd.exe	85
PID 4608 wrote to memory of 1144	4608	Dism.exe	86
PID 808 wrote to memory of 392	808	cmd.exe	88
PID 808 wrote to memory of 4184	808	cmd.exe	89
PID 808 wrote to memory of 432	808	cmd.exe	90
PID 808 wrote to memory of 3052	808	cmd.exe	91
PID 808 wrote to memory of 4044	808	cmd.exe	92
PID 808 wrote to memory of 3080	808	cmd.exe	93
PID 808 wrote to memory of 2612	808	cmd.exe	94
PID 808 wrote to memory of 1708	808	cmd.exe	95
PID 808 wrote to memory of 2580	808	cmd.exe	96
PID 808 wrote to memory of 3420	808	cmd.exe	97
PID 808 wrote to memory of 4728	808	cmd.exe	98
PID 808 wrote to memory of 1608	808	cmd.exe	100
PID 808 wrote to memory of 1164	808	cmd.exe	101
PID 808 wrote to memory of 1392	808	cmd.exe	102
PID 808 wrote to memory of 3512	808	cmd.exe	104
PID 808 wrote to memory of 2516	808	cmd.exe	105
PID 808 wrote to memory of 2252	808	cmd.exe	106
PID 808 wrote to memory of 4048	808	cmd.exe	107
PID 808 wrote to memory of 3336	808	cmd.exe	108
PID 808 wrote to memory of 4120	808	cmd.exe	109
PID 808 wrote to memory of 4536	808	cmd.exe	110
PID 808 wrote to memory of 1936	808	cmd.exe	111
PID 808 wrote to memory of 404	808	cmd.exe	113
PID 808 wrote to memory of 4124	808	cmd.exe	114
PID 808 wrote to memory of 4512	808	cmd.exe	115
PID 808 wrote to memory of 3204	808	cmd.exe	116
PID 808 wrote to memory of 936	808	cmd.exe	117
PID 808 wrote to memory of 1156	808	cmd.exe	118
PID 808 wrote to memory of 1716	808	cmd.exe	119
PID 808 wrote to memory of 2788	808	cmd.exe	120
PID 808 wrote to memory of 4752	808	cmd.exe	121
PID 808 wrote to memory of 3456	808	cmd.exe	122
PID 808 wrote to memory of 3892	808	cmd.exe	123
PID 808 wrote to memory of 2464	808	cmd.exe	124
PID 808 wrote to memory of 4420	808	cmd.exe	125
PID 808 wrote to memory of 1676	808	cmd.exe	126
PID 808 wrote to memory of 1160	808	cmd.exe	127
PID 808 wrote to memory of 3088	808	cmd.exe	128
PID 808 wrote to memory of 4428	808	cmd.exe	129
PID 808 wrote to memory of 2588	808	cmd.exe	130
PID 808 wrote to memory of 4252	808	cmd.exe	131
PID 808 wrote to memory of 3992	808	cmd.exe	132
PID 808 wrote to memory of 1992	808	cmd.exe	133
PID 808 wrote to memory of 1652	808	cmd.exe	134
PID 808 wrote to memory of 4520	808	cmd.exe	135
PID 808 wrote to memory of 244	808	cmd.exe	136
PID 808 wrote to memory of 220	808	cmd.exe	137
PID 808 wrote to memory of 4768	808	cmd.exe	139
PID 808 wrote to memory of 4604	808	cmd.exe	140
PID 808 wrote to memory of 4288	808	cmd.exe	141
PID 808 wrote to memory of 912	808	cmd.exe	142
PID 808 wrote to memory of 2308	808	cmd.exe	144
PID 808 wrote to memory of 5060	808	cmd.exe	145
PID 808 wrote to memory of 1240	808	cmd.exe	146
PID 808 wrote to memory of 3800	808	cmd.exe	147
PID 808 wrote to memory of 4852	808	cmd.exe	148
PID 808 wrote to memory of 3324	808	cmd.exe	149
PID 808 wrote to memory of 2320	808	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cisteni.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3588
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1148
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:580
- C:\Windows\system32\Dism.exe
  dism /online /cleanup-image /restorehealth
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\6F589BEB-78F6-44E2-959D-890F4DF9E1D5\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\6F589BEB-78F6-44E2-959D-890F4DF9E1D5\dismhost.exe {14602A88-C57D-48EB-95DA-B4F7B6674897}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1144
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:392
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s
  2⤵
  PID:4184
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" /s
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /s
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /s
  2⤵
  PID:3420
- C:\Windows\system32\reg.exe
  reg query "HKLM\System\CurrentControlSet\Services" /s /v ImagePath
  2⤵
  - Maps connected drives based on registry
  PID:4728
- C:\Windows\System32\Wbem\WMIC.exe
  wmic process get Name,ExecutablePath
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\system32\findstr.exe
  findstr /i "AppData"
  2⤵
  PID:1164
- C:\Windows\system32\findstr.exe
  findstr /i /v "Temp"
  2⤵
  PID:1392
- C:\Windows\System32\Wbem\WMIC.exe
  wmic process get Name,ExecutablePath
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\system32\findstr.exe
  findstr /i "AppData\Local\Temp"
  2⤵
  PID:2516
- C:\Windows\system32\schtasks.exe
  schtasks /query /fo LIST /v
  2⤵
  PID:2252
- C:\Windows\system32\findstr.exe
  findstr /i /v "Microsoft"
  2⤵
  PID:4048
- C:\Windows\system32\findstr.exe
  findstr /i "TaskName Author TaskToRun"
  2⤵
  PID:3336
- C:\Windows\system32\driverquery.exe
  driverquery /v /fo LIST
  2⤵
  PID:4120
- C:\Windows\system32\findstr.exe
  findstr /i /v "Microsoft"
  2⤵
  PID:4536
- C:\Windows\system32\findstr.exe
  findstr /i "Module Display Name Name Link Date Driver Type"
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg export "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" "C:\Users\Admin\Desktop\Zaloha_Registru\Winlogon_Zaloha.reg" /y
  2⤵
  PID:404
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" "C:\Users\Admin\Desktop\Zaloha_Registru\DefenderPolicies_Zaloha.reg" /y
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4512
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe," /f
  2⤵
  - Modifies WinLogon for persistence
  PID:3204
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:936
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe," /f
  2⤵
  - Modifies WinLogon for persistence
  PID:1156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "0" /f
  2⤵
  PID:1716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoRestartShell /t REG_DWORD /d 1 /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DisableCAD /f
  2⤵
  PID:4752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Classes\.exe" /ve /t REG_SZ /d "exefile" /f
  2⤵
  - Modifies registry class
  PID:3456
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Classes\exefile\shell\open\command" /ve /t REG_SZ /d "\"%1\" %*" /f
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:3892
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Classes\exefile\shell\runas\command" /ve /t REG_SZ /d "\"%1\" %*" /f
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:2464
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Classes\comfile\shell\open\command" /ve /t REG_SZ /d "\"%1\" %*" /f
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:4420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Classes\piffile\shell\open\command" /ve /t REG_SZ /d "\"%1\" %*" /f
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:1676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "" /f
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t REG_SZ /d "" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d "0" /f
  2⤵
  PID:2588
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v AutoColorization /t REG_DWORD /d 1 /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /f
  2⤵
  PID:3992
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /f
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /f
  2⤵
  PID:244
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
  2⤵
  PID:220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 1 /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:4604
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4288
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableRealtimeMonitoring /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:912
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRealtimeMonitoring /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2308
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableBehaviorMonitoring /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:5060
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableOnAccessProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1240
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableIOAVProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3800
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v EnableFirewall /t REG_DWORD /d 1 /f
  2⤵
  - Modifies firewall policy service
  - Modifies registry key
  PID:4852
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Services\WinDefend /v Start /t REG_DWORD /d 2 /f
  2⤵
  - Modifies security service
  - Modifies registry key
  PID:3324
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2320
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1272
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:3320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:5000
- C:\Windows\system32\net.exe
  net stop bits
  2⤵
  PID:4040
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop bits
    3⤵
    PID:1432
- C:\Windows\system32\net.exe
  net start wuauserv
  2⤵
  PID:792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start wuauserv
    3⤵
    PID:468
- C:\Windows\system32\net.exe
  net start bits
  2⤵
  PID:4556
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start bits
    3⤵
    PID:2456
- C:\Windows\system32\sc.exe
  sc config WinDefend start= auto
  2⤵
  - Launches sc.exe
  PID:2252
- C:\Windows\system32\sc.exe
  sc start WinDefend
  2⤵
  - Launches sc.exe
  PID:2640
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start= auto
  2⤵
  - Launches sc.exe
  PID:3344
- C:\Windows\system32\sc.exe
  sc start SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4424
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer /v SmartScreenEnabled /t REG_SZ /d RequireAdmin /f
  2⤵
  - Modifies registry key
  PID:2156
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Services\wscsvc /v Start /t REG_DWORD /d 2 /f
  2⤵
  - Modifies security service
  - Modifies registry key
  PID:4264
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order /v ProviderOrder /t REG_SZ /d RDPNP,LanmanWorkstation,webclient /f
  2⤵
  - Modifies registry key
  PID:3632
- C:\Windows\system32\reg.exe
  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects /f
  2⤵
  - Modifies registry key
  PID:1872
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects /f
  2⤵
  - Modifies registry key
  PID:1704
- C:\Windows\system32\reg.exe
  reg delete HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions /f
  2⤵
  - Modifies registry key
  PID:2684
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions /f
  2⤵
  - Modifies registry key
  PID:1520
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v "Security Packages" /t REG_MULTI_SZ /d kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u /f
  2⤵
  - Modifies registry key
  PID:4760
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v "Notification Packages" /t REG_MULTI_SZ /d scecli /f
  2⤵
  - Boot or Logon Autostart Execution: Authentication Package
  - Modifies registry key
  PID:1496
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v "Authentication Packages" /t REG_MULTI_SZ /d msv1_0 /f
  2⤵
  - Boot or Logon Autostart Execution: Authentication Package
  - Modifies registry key
  PID:688
- C:\Windows\system32\reg.exe
  reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify /f
  2⤵
  - Modifies registry key
  PID:684
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify /f
  2⤵
  - Modifies registry key
  PID:2412
- C:\Windows\system32\reg.exe
  reg delete HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Taskman /f
  2⤵
  - Modifies registry key
  PID:2740
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /f
  2⤵
  - Modifies registry key
  PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2952
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components"
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "
  2⤵
  PID:2324
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2476
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}" /f
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1FC9AB62-9B2E-3666-B314-B16FD09E7C52} "
  2⤵
  PID:4116
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "
  2⤵
  PID:2488
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} "
  2⤵
  PID:4932
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515} "
  2⤵
  PID:1492
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} "
  2⤵
  PID:3124
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515} "
  2⤵
  PID:4060
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} "
  2⤵
  PID:1068
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} "
  2⤵
  PID:3284
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9} "
  2⤵
  PID:4976
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} "
  2⤵
  PID:4604
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} "
  2⤵
  PID:4968
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} "
  2⤵
  PID:2308
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} "
  2⤵
  PID:2176
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} "
  2⤵
  PID:1768
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} "
  2⤵
  PID:3796
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} "
  2⤵
  PID:1684
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:3324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5} "
  2⤵
  PID:2248
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} "
  2⤵
  PID:3416
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600} "
  2⤵
  PID:4960
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} "
  2⤵
  PID:4392
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} "
  2⤵
  PID:4720
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FEBEF00C-046D-438D-8A88-BF94A6C9E703} "
  2⤵
  PID:1272
- C:\Windows\system32\findstr.exe
  findstr /i "{"
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\COM3\FastProx /ve /t REG_SZ /d %SystemRoot%\system32\wbem\fastprox.dll /f
  2⤵
  - Modifies registry key
  PID:4984
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f
  2⤵
  - Modifies registry key
  PID:1080
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Classes\CLSID\{F04A1B42-8D39-4aa1-8591-9E2FA5466456} /f
  2⤵
  - Modifies registry key
  PID:3832
- C:\Windows\system32\bcdboot.exe
  bcdboot C:\Windows /l cs-CZ /f ALL
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 0 /f
  2⤵
  PID:468
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 0 /f
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 0 /f
  2⤵
  PID:2296
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 0 /f
  2⤵
  PID:3024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 0 /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 0 /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f
  2⤵
  - UAC bypass
  PID:4424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v shutdownwithoutlogon /t REG_DWORD /d 1 /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v UseDefaultTile /t REG_DWORD /d 0 /f
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 0 /f
  2⤵
  PID:392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableLogonBackgroundImage /t REG_DWORD /d 0 /f
  2⤵
  PID:1868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 0 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:1752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 0 /f
  2⤵
  PID:2156
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 0 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:4620
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 0 /f
  2⤵
  PID:2148
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Classes\ms-settings" /f
  2⤵
  PID:1704

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies registry class
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Authentication Package

T1547.002

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Authentication Package

T1547.002

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry