sheetrat | 32d7475a7c536189bc6c57ed33a0cf5d76ba2184816f629aa85d4bab6f1ad672

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	MicrosoftEdgeUpdate.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MicrosoftEdgeUpdate.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

persistence privilege_escalation

Disable or Modify System Firewall

T1562.004

pid	Process
5484	netsh.exe
4996	netsh.exe
2976	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
5868	NewLauncher-2.0.9-windows-x64.exe
4888	MicrosoftEdgeUpdate.exe
5580	MicrosoftEdgeUpdate.exe
4272	SearchApp.exe
2684	M1004NUS.exe
3216	BootExecutor.exe

Loads dropped DLL 7 IoCs

pid	Process
5868	NewLauncher-2.0.9-windows-x64.exe
5868	NewLauncher-2.0.9-windows-x64.exe
5868	NewLauncher-2.0.9-windows-x64.exe
5868	NewLauncher-2.0.9-windows-x64.exe
5360	Process not Found
5360	Process not Found
5360	Process not Found

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	MicrosoftEdgeUpdate.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeUpdate.exe

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	MicrosoftEdgeUpdate.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	MicrosoftEdgeUpdate.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	MicrosoftEdgeUpdate.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1264	sc.exe
1428	sc.exe
4416	sc.exe
3184	sc.exe
5228	sc.exe
804	sc.exe
3384	sc.exe
4248	sc.exe
1268	sc.exe
3740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
252	cmd.exe
5960	cmd.exe
3848	CMD.exe
3276	cmd.exe
3968	cmd.exe
2576	cmd.exe
4564	cmd.exe
5248	cmd.exe
4124	cmd.exe
5816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewLauncher-2.0.9-windows-x64.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	MicrosoftEdgeUpdate.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4588	schtasks.exe
1088	schtasks.exe
3556	schtasks.exe
3252	schtasks.exe
804	schtasks.exe
4188	schtasks.exe
5248	schtasks.exe
6052	schtasks.exe
4208	schtasks.exe
4452	schtasks.exe
3040	schtasks.exe
124	schtasks.exe
2900	schtasks.exe
5424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
4888	MicrosoftEdgeUpdate.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe
3216	BootExecutor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5360	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5580	MicrosoftEdgeUpdate.exe
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeDebugPrivilege	4888	MicrosoftEdgeUpdate.exe
Token: SeTakeOwnershipPrivilege	4888	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	4888	MicrosoftEdgeUpdate.exe
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeDebugPrivilege	2684	M1004NUS.exe
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeDebugPrivilege	3216	BootExecutor.exe
Token: SeDebugPrivilege	4272	SearchApp.exe
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5360	Process not Found
5360	Process not Found

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 5868	4712	NewLauncher-2.0.9-windows-x64.exe	89
PID 4712 wrote to memory of 4888	4712	NewLauncher-2.0.9-windows-x64.exe	90
PID 4888 wrote to memory of 252	4888	MicrosoftEdgeUpdate.exe	93
PID 252 wrote to memory of 5484	252	cmd.exe	95
PID 4888 wrote to memory of 4248	4888	MicrosoftEdgeUpdate.exe	96
PID 4888 wrote to memory of 1264	4888	MicrosoftEdgeUpdate.exe	98
PID 4888 wrote to memory of 1428	4888	MicrosoftEdgeUpdate.exe	100
PID 4888 wrote to memory of 4416	4888	MicrosoftEdgeUpdate.exe	102
PID 4888 wrote to memory of 1916	4888	MicrosoftEdgeUpdate.exe	105
PID 4888 wrote to memory of 5560	4888	MicrosoftEdgeUpdate.exe	107
PID 4888 wrote to memory of 4276	4888	MicrosoftEdgeUpdate.exe	110
PID 4888 wrote to memory of 6016	4888	MicrosoftEdgeUpdate.exe	112
PID 4888 wrote to memory of 1268	4888	MicrosoftEdgeUpdate.exe	114
PID 4888 wrote to memory of 4976	4888	MicrosoftEdgeUpdate.exe	116
PID 4888 wrote to memory of 1848	4888	MicrosoftEdgeUpdate.exe	118
PID 4888 wrote to memory of 4648	4888	MicrosoftEdgeUpdate.exe	120
PID 4888 wrote to memory of 3816	4888	MicrosoftEdgeUpdate.exe	122
PID 4888 wrote to memory of 4180	4888	MicrosoftEdgeUpdate.exe	124
PID 4888 wrote to memory of 3500	4888	MicrosoftEdgeUpdate.exe	126
PID 4888 wrote to memory of 436	4888	MicrosoftEdgeUpdate.exe	128
PID 4888 wrote to memory of 3316	4888	MicrosoftEdgeUpdate.exe	130
PID 4888 wrote to memory of 4588	4888	MicrosoftEdgeUpdate.exe	133
PID 4888 wrote to memory of 5960	4888	MicrosoftEdgeUpdate.exe	136
PID 5960 wrote to memory of 1088	5960	cmd.exe	138
PID 4888 wrote to memory of 5200	4888	MicrosoftEdgeUpdate.exe	139
PID 4888 wrote to memory of 3384	4888	MicrosoftEdgeUpdate.exe	141
PID 4888 wrote to memory of 5592	4888	MicrosoftEdgeUpdate.exe	143
PID 4888 wrote to memory of 4656	4888	MicrosoftEdgeUpdate.exe	145
PID 4888 wrote to memory of 4208	4888	MicrosoftEdgeUpdate.exe	147
PID 4888 wrote to memory of 2732	4888	MicrosoftEdgeUpdate.exe	149
PID 4888 wrote to memory of 3848	4888	MicrosoftEdgeUpdate.exe	150
PID 4888 wrote to memory of 3276	4888	MicrosoftEdgeUpdate.exe	152
PID 4888 wrote to memory of 4124	4888	MicrosoftEdgeUpdate.exe	153
PID 4888 wrote to memory of 5816	4888	MicrosoftEdgeUpdate.exe	156
PID 4888 wrote to memory of 3968	4888	MicrosoftEdgeUpdate.exe	158
PID 3848 wrote to memory of 4612	3848	CMD.exe	161
PID 3276 wrote to memory of 3556	3276	cmd.exe	162
PID 4124 wrote to memory of 3252	4124	cmd.exe	163
PID 5816 wrote to memory of 4452	5816	cmd.exe	164
PID 3968 wrote to memory of 804	3968	cmd.exe	165
PID 4888 wrote to memory of 1124	4888	MicrosoftEdgeUpdate.exe	167
PID 4888 wrote to memory of 4188	4888	MicrosoftEdgeUpdate.exe	169
PID 4888 wrote to memory of 2684	4888	MicrosoftEdgeUpdate.exe	171
PID 5360 wrote to memory of 1012	5360	Process not Found
PID 5360 wrote to memory of 1012	5360	Process not Found
PID 3216 wrote to memory of 2576	3216	BootExecutor.exe	175
PID 2576 wrote to memory of 4996	2576	cmd.exe	177
PID 3216 wrote to memory of 4936	3216	BootExecutor.exe	178
PID 3216 wrote to memory of 3184	3216	BootExecutor.exe	180
PID 3216 wrote to memory of 4248	3216	BootExecutor.exe	182
PID 3216 wrote to memory of 1268	3216	BootExecutor.exe	184
PID 3216 wrote to memory of 5616	3216	BootExecutor.exe	186
PID 3216 wrote to memory of 5248	3216	BootExecutor.exe	188
PID 3216 wrote to memory of 1572	3216	BootExecutor.exe	190
PID 3216 wrote to memory of 6052	3216	BootExecutor.exe	192
PID 3216 wrote to memory of 5452	3216	BootExecutor.exe	194
PID 3216 wrote to memory of 3524	3216	BootExecutor.exe	196
PID 3216 wrote to memory of 1188	3216	BootExecutor.exe	198
PID 3216 wrote to memory of 3040	3216	BootExecutor.exe	200
PID 3216 wrote to memory of 4324	3216	BootExecutor.exe	202
PID 3216 wrote to memory of 124	3216	BootExecutor.exe	204
PID 3216 wrote to memory of 5596	3216	BootExecutor.exe	206
PID 3216 wrote to memory of 3416	3216	BootExecutor.exe	208
PID 3216 wrote to memory of 2900	3216	BootExecutor.exe	210

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\NewLauncher-2.0.9-windows-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Roaming\NewLauncher-2.0.9-windows-x64.exe
  "C:\Users\Admin\AppData\Roaming\NewLauncher-2.0.9-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe
  "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5484
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1264
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:4416
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    PID:1916
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:5560
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    PID:4276
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:6016
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:1268
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:4976
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:1848
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:3816
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:4180
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:3500
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:436
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_4ca80104" /F
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_4ca80104" /XML "C:\Users\Admin\AppData\Local\Temp\ee0d339e-73c7-4684-9765-0b3b84cd4021.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:5200
- - C:\Windows\SYSTEM32\sc.exe
    "sc" start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:3384
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "UsbCeip_10978c4c" /F
    3⤵
    PID:5592
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:4656
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "UsbCeip_10978c4c" /XML "C:\Users\Admin\AppData\Local\Temp\eac12579-9bc8-4a5b-921a-094c4a20150c.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    PID:2732
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "MicrosoftEdgeUpdate" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "MicrosoftEdgeUpdate"
      4⤵
      PID:4612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3556
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4452
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "MicrosoftEdgeUpdate_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:804
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "CCleanerSkipUAC_8c34fba0" /F
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "CCleanerSkipUAC_8c34fba0" /XML "C:\Users\Admin\AppData\Local\Temp\fd587888-370e-4d1e-bb5d-9c836300b943.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4188
- - C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
    "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2684
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
      4⤵
      Executes a command shell one-liner
      PID:4564
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2976
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" E: /S
      4⤵
      PID:980
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:5228
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:804
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
      4⤵
      Launches sc.exe
      PID:3740

C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\SearchApp.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4996
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4248
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1268
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9a12550b" /F
  2⤵
  PID:5616
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9a12550b" /XML "C:\Users\Admin\AppData\Local\Temp\8cb58163-92ef-4679-af4f-d3483e9eb96e.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5248
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_20f2e4dd" /F
  2⤵
  PID:1572
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_20f2e4dd" /XML "C:\Users\Admin\AppData\Local\Temp\f255d439-5521-4cf7-b5cd-30abcf3c1aa6.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6052
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:5452
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:3524
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_d38926d0" /F
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_d38926d0" /XML "C:\Users\Admin\AppData\Local\Temp\8a6dacff-7db2-41c0-81b6-81ccf9c7d482.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_daf2df0e" /F
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_daf2df0e" /XML "C:\Users\Admin\AppData\Local\Temp\f19893db-b302-44f2-86de-d9ce7d3d8fb8.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:124
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_bfa92126" /F
  2⤵
  PID:5596
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:3416
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_bfa92126" /XML "C:\Users\Admin\AppData\Local\Temp\b80a0547-2072-4c10-a25c-69f6b012fce1.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2900
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:3676
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f16add85" /F
  2⤵
  PID:2760
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f16add85" /XML "C:\Users\Admin\AppData\Local\Temp\d0f02e13-69fd-475e-945e-2a14a80171cc.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5424
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:1560
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:4908
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:952
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:3080
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:1088
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:4532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:5384
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:2972
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:3076
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:3452
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:3948
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:5516
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:5560
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:4648
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:4120
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:1348
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:1944
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  - Enumerates connected drives
  PID:4904
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:5156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  PID:5248
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    PID:124

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
PID:624

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399d055 /state1:0x41c64e6d
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry